tango-kni/bin/kniconf/maat_test.json

{
    "compile_table": "WHITE_LIST_COMPILE",
    "group_table": "WHITE_LIST_GROUP",
    "rules": [
        {
            "compile_id": 1,
            "service": 1,
            "action":123,
            "do_blacklist": 1,
            "do_log": 1,
            "effective_rage": 0,
            "user_region": "anything",
            "is_valid": "yes",
            "groups": [
                {
                    "group_name": "group_1",
                    "regions": [
                        {
                            "table_name": "WHITE_LIST_IP",
                            "table_type": "ip",
                            "table_content": {
                                "addr_type": "ipv4",
                                "src_ip": "192.168.11.119",
                                "mask_src_ip": "255.255.255.255",
                                "src_port": "0",
                                "mask_src_port": "65535",
                                "dst_ip": "0.0.0.0",
                                "mask_dst_ip": "255.255.255.255",
                                "dst_port": "0",
                                "mask_dst_port": "65535",
                                "protocol": 0,
                                "direction": "double"
                            }
                        }
                    ]
                }
            ]
        },
	{
            "compile_id": 2,
            "service": 48,
            "action": 123,
            "do_blacklist": 1,
            "do_log": 1,
            "effective_rage": 0,
            "user_region": "anything",
            "is_valid": "yes",
            "groups": [
                {
                    "group_name": "group_2",
                    "regions": [
                        {
                            "table_name": "WHITE_LIST_DOMAIN",
                            "table_type": "string",
                            "table_content": {
                                "keywords": "www.baidu.com",
                                "expr_type": "regex",
                                "match_method": "sub",
				"format":"uncase plain"
                            }
                        }
                    ]
                }
            ]
        }
	]
}