I apologize for my confusing example where I changed from MAC address to IP address half way through my email.. I have not yet had enough coffee...
Here is a re-write of my email
--
Actually - when trying to write this example, I have run into another issue WRT patterning and our decision for some list properties to be able to continue multiple types simultaneously, along with the "always deref" decision.
Take the network-connection src_ref type. How would I write a pattern comparing this against an IPv4 address?
You can't simply do this:
network-connection-object:src_ref.value = '1.2.3.4'
.. because there is no way for me to declare that the type is a IPv4 address and not something else that looks like it
It is like you *always* have to write the type...
network-connection-object:src_ref.type = 'ipv4-address-object' AND network-connection-object:src_ref.value = '1.2.3.4'
Actually - when trying to write this example, I have run into another issue WRT patterning and our decision for some list properties to be able to continue multiple types simultaneously, along with the "always deref" decision.
Take the network-connection src_ref type. How would I write a pattern comparing this against a MAC address?
You can't simply do this:
network-connection-object:src_ref.value = '42:29:82:8d:b5:a9'
.. because there is no way for me to declare that the type is a IPv4 address and not something else
It is like you *always* have to write the type...
network-connection-object:src_ref.type = 'ipv4-address-object' AND network-connection-object:src_ref.value = '1.2.3.4'
... this will be quite cumbersome...
-
Jason Keirstead
STSM, Product Architect, Security Intelligence, IBM Security Systems
www.ibm.com/security | www.securityintelligence.com
Without data, all you are is just another person with an opinion - Unknown
<trim>