If you've ever wondered what levers you have available to pull for creating application rule logic then this is your one stop shop for an explanation.
There's a fully documented cheat sheet of the parameters you can use in application rules, located at the link below:
Application Rules Cheat Sheet
There are some commands that I personally wasn't aware of. For example, using ~ instead of not() to negate the contains/begins/ends functions and I had forgotten about the ucount and unique operators that are available.
Also, v11.x introduced the ability to have metakeys on both the left and right side of operators (the table in that link explains which ones are available).
Overall, this is a good resource to bookmark if you are developing application rules in RSA NetWitness.
