question on parsers and rules

[huanzhou1]

Hi Guys,

Just to get confirmation, when events or network session parsed by decoder, each event or session ran though all the parsers and rules?

[RSAAdmin]

Generally, yes, but they don't have to.

You can create app/net rules with the "Stop rule processing" option to force no further rule processing for a matching session.  This is often done if you are using app or net rules to filter out and discard traffic - if you want to get rid of it, there may be no reason to run it through all of your other rules.

I believe you can disable individual parsers (/decoder/parsers/definitions/<parsername>/enabled  = no) and feeds (/decoder/parsers/feeds/<feedname>/feed.enabled = no), though I haven't actually tried these.

[huanzhou1]

Thanks. So far parsers, the event or session has to pass all the enabled parsers?

For rules, it will pass all the rules unless "stop rule processing" enabled. Does it apply to one type of rules? For example, i have network rules and app rules, one of the network rules contains "stop rule procession", will the app rules contine to process?

thanks.