From 1b8aed8abd890b1c363b86e558b509402fc70c37 Mon Sep 17 00:00:00 2001 From: Sean Whalen Date: Fri, 29 Dec 2023 11:07:10 -0500 Subject: [PATCH] Fix typo in example rule --- docs/source/tutorial.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/source/tutorial.md b/docs/source/tutorial.md index 1452668..52015a6 100644 --- a/docs/source/tutorial.md +++ b/docs/source/tutorial.md @@ -357,7 +357,7 @@ rule planet_express_vip_impersonation { description = "Impersonation of key employees of Planet Express" strings: /* - /(Hubert|Hugh|Prof\\.?(essor)?) ((Hubert|Hugh) )?Farnsworth/ + /(Hubert|Hugh|Prof\.?(essor)?) ((Hubert|Hugh) )?Farnsworth/ Hubert Farnsworth Hugh Farnsworth @@ -371,7 +371,7 @@ rule planet_express_vip_impersonation { Prof. Hugh Farnsworth Prof Hugh Farnsworth - /Phil(ip)? (J\\.? )?Fry/ + /Phil(ip)? (J\.? )?Fry/ Philip Fry Philip J. Fry @@ -381,11 +381,11 @@ rule planet_express_vip_impersonation { Phil J Fry */ $external = "[EXT]" ascii wide nocase // External email warning - $vip_ceo = /(Hubert|Hugh|Prof\\.?(essor)?) ((Hubert|Hugh) )?Farnsworth/ ascii wide nocase + $vip_ceo = /(Hubert|Hugh|Prof\.?(essor)?) ((Hubert|Hugh) )?Farnsworth/ ascii wide nocase $vip_cfo = "Hermes Conrad" ascii wide nocase $vip_cto = "Turanga Leela" ascii wide nocase $vip_admin = "Amy Wong" ascii wide nocase - $vip_cdo = /Phil(ip)? (J\\.? )?Fry/ ascii wide nocase + $vip_cdo = /Phil(ip)? (J\.? )?Fry/ ascii wide nocase $except_slug = "Brain Slug Fundraiser" ascii wide condition: $external and any of ($vip_*) and not any of ($except_*)