{ "compile_table": "COMPILE_DEFAULT", "group2compile_table": "GROUP2COMPILE_DEFAULT", "group2group_table": "GROUP2GROUP", "groups": [ { "group_name": "ASN1234", "group_id": 1, "regions": [ { "table_name": "AS_NUMBER", "table_type": "expr", "table_content": { "keywords": "AS1234", "expr_type": "none", "match_method": "exact", "format": "uncase plain" } } ] }, { "group_name": "ASN2345", "group_id": 2, "regions": [ { "table_name": "AS_NUMBER", "table_type": "expr", "table_content": { "keywords": "AS2345", "expr_type": "none", "match_method": "exact", "format": "uncase plain" } } ] }, { "group_name": "financial-department-ip", "group_id": 3, "regions": [ { "table_name": "IP_CONFIG", "table_type": "ip_plus", "table_content": { "addr_type": "ipv4", "addr_format": "mask", "ip1": "192.168.40.88", "ip2": "255.255.255.255", "port_format": "range", "port1": "0", "port2": "65535", "protocol": 6 } } ] }, { "group_name": "Country-Sparta-IP", "group_id": 4, "regions": [ { "table_name": "GeoLocation", "table_type": "expr", "table_content": { "keywords": "Greece.Sparta", "expr_type": "none", "match_method": "exact", "format": "uncase plain" } } ] }, { "group_name": "IPv4-composition-source-only", "group_id": 5, "regions": [ { "table_type": "ip_plus", "table_name": "IP_PLUS_CONFIG", "table_content": { "addr_type": "ipv4", "addr_format": "single", "ip1": "192.168.50.24", "ip2": "192.168.50.24", "port_format": "range", "port1": "39000", "port2": "40000", "protocol": 6 } } ] }, { "group_name": "FQDN_OBJ1", "group_id": 6, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": "sports.example.com", "expr_type": "none", "match_method": "exact", "format": "uncase plain" } } ] }, { "group_name": "FQDN_CAT1", "group_id": 7, "regions": [ { "table_name": "INTERGER_PLUS", "table_type": "interval_plus", "table_content": { "district": "fqdn_cat_id", "low_boundary": 1724, "up_boundary": 1724 } } ] }, { "group_name": "IPv4-composition-NOT-client-ip", "group_id": 8, "regions": [ { "table_type": "ip_plus", "table_name": "IP_PLUS_CONFIG", "table_content": { "addr_type": "ipv4", "addr_format": "single", "ip1": "192.168.58.19", "ip2": "192.168.58.19", "port_format": "single", "port1": "20000", "port2": "20000", "protocol": 6 } } ] }, { "group_name": "IPv4-composition-NOT-server-ip", "group_id": 9, "regions": [ { "table_type": "ip_plus", "table_name": "IP_PLUS_CONFIG", "table_content": { "addr_type": "ipv4", "addr_format": "range", "ip1": "10.0.1.20", "ip2": "10.0.1.25", "port_format": "range", "port1": "1", "port2": "443", "protocol": 6 } } ] } ], "rules": [ { "compile_id": 123, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "escaped\\bdata:have\\ba\\bspace\\band\\ba\\b\\&\\bsymbol.", "is_valid": "yes", "groups": [ { "virtual_table": "IP_CONFIG", "group_name": "123_IP_group", "group_id": 10, "regions": [ { "table_name": "IP_CONFIG", "table_type": "ip_plus", "table_content": { "addr_type": "ipv4", "addr_format": "mask", "ip1": "10.0.6.201", "ip2": "255.255.0.0", "port_format": "range", "port1": "0", "port2": "65535", "protocol": 6 } }, { "table_name": "IP_CONFIG", "table_type": "ip_plus", "table_content": { "addr_type": "ipv6", "addr_format": "mask", "ip1": "2001:da8:205:1::101", "ip2": "ffff:ffff:ffff:ffff:ffff:ffff:ffff:0000", "port_format": "range", "port1": "0", "port2": "65535", "protocol": 6 } } ] }, { "virtual_table": "HTTP_URL", "group_name": "123_url_group", "group_id": 11, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "abckkk&123", "expr_type": "and", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 124, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "anything", "is_valid": "yes", "groups": [ { "virtual_table":"IP_CONFIG", "group_name": "123_IP_group" }, { "virtual_table": "CONTENT_SIZE", "group_name": "124_interval_group", "group_id": 12, "regions": [ { "table_name": "CONTENT_SIZE", "table_type": "interval", "table_content": { "low_boundary": 100, "up_boundary": 500 } } ] } ] }, { "compile_id": 125, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "anything", "is_valid": "yes", "groups": [ { "virtual_table":"HTTP_URL", "group_name": "125_url_group", "group_id": 13, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "action=search\\&query=(.*)", "expr_type": "regex", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 126, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "anything", "is_valid": "yes", "groups": [ { "virtual_table": "HTTP_URL", "group_name": "126_url_group", "group_id": 14, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "should_not_hit_any_rule", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "virtual_table": "CONTENT_SIZE", "group_name": "126_interval_group", "group_id": 15, "regions": [ { "table_name": "CONTENT_SIZE", "table_type": "interval", "table_content": { "low_boundary": 2014, "up_boundary": 2016 } } ] } ] }, { "compile_id": 128, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "StringScan.ExprPlus", "is_valid": "yes", "groups": [ { "virtual_table": "HTTP_SIGNATURE", "group_name": "128_expr_plus_group", "group_id": 16, "regions": [ { "table_name": "HTTP_SIGNATURE", "table_type": "expr_plus", "table_content": { "district": "HtTP\\bUrL", "keywords": "abckkk&123", "expr_type": "and", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 129, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "utf8_中文", "is_valid": "yes", "groups": [ { "virtual_table": "HTTP_URL", "group_name": "129_url_group", "group_id": 17, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "C#中国", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 130, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "utf8_维语", "is_valid": "yes", "groups": [ { "virtual_table": "KEYWORDS_TABLE", "group_name": "130_keywords_group", "group_id": 18, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": "2010&يىلىدىكى", "expr_type": "and", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 131, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "utf8_维语2", "is_valid": "yes", "groups": [ { "virtual_table": "KEYWORDS_TABLE", "group_name": "131_keywords_group", "group_id": 19, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": "سىياسىي", "expr_type": "and", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 132, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "string\\bunescape", "is_valid": "yes", "groups": [ { "virtual_table": "KEYWORDS_TABLE", "group_name": "TakeMeHome", "group_id": 20, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": "Take\\bme\\bHome&Batman\\", "expr_type": "and", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 133, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "13018_table_conjunction_test_part1\bnow_its_very_very_long0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz", "is_valid": "yes", "groups": [ { "virtual_table": "HTTP_HOST", "group_name": "133_host_group", "group_id": 21, "regions": [ { "table_name": "HTTP_HOST", "table_type": "expr", "table_content": { "keywords": "www.3300av.com", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 134, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "table_conjunction_test_part2", "is_valid": "yes", "groups": [ { "virtual_table": "HTTP_URL", "group_name": "134_url_group", "group_id": 22, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "novel&27122.txt", "expr_type": "and", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 136, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "offset_string", "is_valid": "yes", "groups": [ { "virtual_table": "IMAGE_FP", "group_name": "136_expr_group", "group_id": 23, "regions": [ { "table_name": "IMAGE_FP", "table_type": "expr", "table_content": { "keywords": "4362-4458:323031333A30333A30372032333A35363A313000323031333A30333A30372032333A35363A3130000000FFE20C584943435F50524F46494C4500010100000C484C696E6F021000006D6E74725247422058595A2007CE00020009000600310000", "expr_type": "offset", "match_method": "none", "format": "hexbin" } } ] } ] }, { "compile_id": 137, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "offset_string", "is_valid": "yes", "groups": [ { "virtual_table": "IMAGE_FP", "group_name": "137_expr_group", "group_id": 24, "regions": [ { "table_name": "IMAGE_FP", "table_type": "expr", "table_content": { "keywords": "19339-19467:6CB2CB2F2028474C994991CCFC65CCA5E3B6FF001673985D157358610CACC674EE64CC27B5721CCDABD9CCA7C8E9F7BB1F54A930A6034D50F92711F5B2DACCB0715D2E6873CE5CE431DC701A194C260E9DB78CC89F2C84745869AB88349A3AE0412AB59D9ABA84EDEFFF0057FA4DA66D333698B5AD6F844DA2226D1CADAD5E44", "expr_type": "offset", "match_method": "none", "format": "hexbin" } } ] } ] }, { "compile_id": 138, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "effective_range": 0, "tags": "{\"tag_sets\":[[{\"tag\":\"location\",\"value\":[\"北京/朝阳/华严北里\",\"上海/浦东/陆家嘴\"]},{\"tag\":\"isp\",\"value\":[\"电信\",\"联通\"]}],[{\"tag\":\"location\",\"value\":[\"北京\"]},{\"tag\":\"isp\",\"value\":[\"联通\"]}]]}", "user_region": "Not\\baccepted\\btags", "is_valid": "yes", "groups": [ { "virtual_table": "HTTP_URL", "group_name": "138_url_group", "group_id": 25, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "should&hit&aaa", "expr_type": "and", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 139, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "effective_range": 0, "tags": "{\"tag_sets\":[[{\"tag\":\"location\",\"value\":[\"北京/朝阳/华严北里\"]},{\"tag\":\"isp\",\"value\":[\"电信\",\"移动\"]}]]}", "user_region": "Accepted\\btags", "is_valid": "yes", "groups": [ { "virtual_table": "HTTP_URL", "group_name": "139_url_group", "group_id": 26, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "should&hit&bbb", "expr_type": "and", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 140, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "file_streams", "is_valid": "yes", "groups": [ { "virtual_table": "KEYWORDS_TABLE", "group_name": "140_keywords_group", "group_id": 27, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": "2018-10-05", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 141, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "Something:I\\bhave\\ba\\bname,7799", "compile_table_name": "COMPILE_ALIAS", "is_valid": "yes", "groups": [ { "g2c_table_name": "GROUP2COMPILE_ALIAS", "virtual_table": "HTTP_URL", "group_name": "141_url_group", "group_id": 28, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "i.ytimg.com", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 142, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "StringScan.UTF8EncodedURL", "is_valid": "yes", "groups": [ { "virtual_table": "HTTP_URL", "group_name": "142_url_group", "group_id": 29, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": ",IgpwcjA0LnN2bzAzKgkxMjcuMC4wLjE", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 143, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "NOTLogic.OneRegion", "is_valid": "yes", "groups": [ { "virtual_table": "HTTP_URL_FILTER", "group_name": "143_url_group1", "group_id": 30, "not_flag": 0, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "must-contained-string-of-rule-143", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "virtual_table": "HTTP_URL_FILTER", "group_name": "143_url_group2", "group_id": 31, "not_flag": 1, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "must-not-contained-string-of-rule-143", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 144, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "NOTLogic.ScanNotAtLast", "is_valid": "yes", "groups": [ { "virtual_table": "HTTP_URL_FILTER", "group_name": "144_url_group", "group_id": 32, "not_flag": 0, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "must-contained-string-of-rule-144", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "virtual_table": "HTTP_RESPONSE_KEYWORDS", "group_name": "144_keywords_group", "group_id": 33, "not_flag": 1, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": "must-not-contained-string-of-rule-144", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 145, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "NOTLogic.ScanNotIP", "is_valid": "yes", "groups": [ { "virtual_table": "HTTP_URL", "group_name": "145_url_group", "group_id": 34, "not_flag": 0, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "must-contained-string-of-rule-145", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "virtual_table": "VIRTUAL_IP_CONFIG", "group_name": "123_IP_group", "not_flag": 1 } ] }, { "compile_id": 146, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "NOTLogic.NotExprClauseAndNotIPClause", "is_valid": "yes", "groups": [ { "virtual_table": "HTTP_URL_FILTER", "group_name": "146_url_group", "group_id": 35, "not_flag": 0, "clause_index": 0, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "must-contained-string-of-rule-146", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "virtual_table": "HTTP_RESPONSE_KEYWORDS", "group_name": "146_keywords_group", "group_id": 36, "not_flag": 1, "clause_index": 1, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": "must-contained-not-string-of-rule-146", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "virtual_table": "VIRTUAL_IP_CONFIG", "group_name": "123_IP_group", "not_flag": 1, "clause_index": 2 } ] }, { "compile_id": 147, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "NOTLogic.8NotClause", "is_valid": "yes", "groups": [ { "virtual_table": "HTTP_RESPONSE_KEYWORDS_1", "group_name": "147_keywords_group1", "group_id": 37, "not_flag": 1, "clause_index": 0, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": "clause0-in-compile-147", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "virtual_table": "HTTP_RESPONSE_KEYWORDS_2", "group_name": "147_keywords_group2", "group_id": 38, "not_flag": 1, "clause_index": 1, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": "clause1-in-compile-147", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "virtual_table": "HTTP_RESPONSE_KEYWORDS_3", "group_name": "147_keywords_group3", "group_id": 39, "not_flag": 1, "clause_index": 2, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": "clause2-in-compile-147", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "virtual_table": "HTTP_RESPONSE_KEYWORDS_4", "group_name": "147_keywords_group4", "group_id": 40, "not_flag": 1, "clause_index": 3, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": "clause3-in-compile-147", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "virtual_table": "HTTP_RESPONSE_KEYWORDS_5", "group_name": "147_keywords_group5", "group_id": 41, "not_flag": 1, "clause_index": 4, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": "clause4-in-compile-147", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "virtual_table": "HTTP_RESPONSE_KEYWORDS_6", "group_name": "147_keywords_group6", "group_id": 42, "not_flag": 1, "clause_index": 5, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": "clause5-in-compile-147", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "virtual_table": "HTTP_RESPONSE_KEYWORDS_7", "group_name": "147_keywords_group7", "group_id": 43, "not_flag": 1, "clause_index": 6, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": "clause6-in-compile-147", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "virtual_table": "HTTP_RESPONSE_KEYWORDS_8", "group_name": "147_keywords_group8", "group_id": 44, "not_flag": 1, "clause_index": 7, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": "clause7-in-compile-147", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 148, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "StringScan.Regex", "is_valid": "yes", "groups": [ { "virtual_table": "HTTP_URL", "group_name": "148_url_group", "group_id": 45, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "Cookie:\\s.*head", "expr_type": "regex", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 149, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "StringScan.ExprPlusWithOffset", "is_valid": "yes", "groups": [ { "virtual_table": "APP_PAYLOAD", "group_name": "149_app_group", "group_id": 46, "regions": [ { "table_name": "APP_PAYLOAD", "table_type": "expr_plus", "table_content": { "format": "hexbin", "match_method": "sub", "district": "Payload", "keywords": "1-1:03&9-10:2d&14-16:2d34&19-21:2d&24-25:2d", "expr_type": "offset" } } ] } ] }, { "compile_id": 150, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "StringScan.BugReport20190325", "is_valid": "yes", "groups": [ { "virtual_table": "TROJAN_PAYLOAD", "group_name": "billgates_regist1", "group_id": 47, "regions": [ { "table_type": "expr", "table_name": "TROJAN_PAYLOAD", "table_content": { "keywords": "0-4:01000000", "expr_type": "offset", "format": "hexbin", "match_method": "sub" } } ] }, { "virtual_table": "TROJAN_PAYLOAD", "group_name": "billgates_regist2", "group_id": 48, "regions": [ { "table_type": "expr", "table_name": "TROJAN_PAYLOAD", "table_content": { "keywords": "1:G2.40", "expr_type": "none", "format": "uncase plain", "match_method": "sub" } } ] } ] }, { "compile_id": 151, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "StringScan.PrefixAndSuffix", "is_valid": "yes", "groups": [ { "virtual_table": "MAIL_ADDR", "group_name": "151_expr_group", "group_id": 49, "regions": [ { "table_type": "expr", "table_name": "MAIL_ADDR", "table_content": { "keywords": "ceshi3@mailhost.cn", "expr_type": "none", "format": "uncase plain", "match_method": "suffix" } } ] } ] }, { "compile_id": 152, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "StringScan.PrefixAndSuffix", "is_valid": "yes", "groups": [ { "virtual_table": "MAIL_ADDR", "group_name": "152_mail_addr", "group_id": 50, "regions": [ { "table_type": "expr", "table_name": "MAIL_ADDR", "table_content": { "keywords": "ceshi3@mailhost.cn", "expr_type": "none", "format": "uncase plain", "match_method": "prefix" } }, { "table_type": "expr", "table_name": "MAIL_ADDR", "table_content": { "keywords": "ceshi6@mailhost.cn", "expr_type": "none", "format": "uncase plain", "match_method": "prefix" } } ] }, { "virtual_table": "CONTENT_SIZE", "group_name": "interval_group_refered", "group_id": 51, "sub_groups": [ { "group_name": "126_interval_group" } ] } ] }, { "compile_id": 153, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "Policy.SubGroup", "is_valid": "yes", "groups": [ { "virtual_table": "MAIL_ADDR", "group_name": "153_expr_group", "group_id": 52, "not_flag": 0, "regions": [ { "table_type": "expr", "table_name": "MAIL_ADDR", "table_content": { "keywords": "ceshi4@mailhost.cn", "expr_type": "none", "format": "uncase plain", "match_method": "prefix" } } ], "sub_groups": [ { "virtual_table": "MAIL_ADDR", "group_name": "152_mail_addr" } ] }, { "virtual_table": "IP_CONFIG", "group_name": "IP_group_refered", "group_id": 53, "sub_groups": [ { "group_name": "123_IP_group" } ] } ] }, { "compile_id": 154, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "ipv4_plus", "is_valid": "yes", "groups": [ { "virtual_table": "IP_PLUS_CONFIG", "group_name": "154_IP_group", "group_id": 54, "not_flag": 0, "regions": [ { "table_type": "ip_plus", "table_name": "IP_PLUS_CONFIG", "table_content": { "addr_type": "ipv4", "addr_format": "range", "ip1": "10.0.7.100", "ip2": "10.0.7.106", "port_format": "range", "port1": "65530", "port2": "65535", "protocol": 6 } } ] } ] }, { "compile_id": 155, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "ipv6_plus", "is_valid": "yes", "groups": [ { "virtual_table": "IP_PLUS_CONFIG", "group_name": "155_IP_group", "group_id": 55, "regions": [ { "table_type": "ip_plus", "table_name": "IP_PLUS_CONFIG", "table_content": { "addr_type": "ipv6", "addr_format": "range", "ip1": "1001:da8:205:1::101", "ip2": "1001:da8:205:1::201", "port_format": "range", "port1": "65510", "port2": "65520", "protocol": 6 } } ], "not_flag": 0 } ] }, { "compile_id": 156, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "ExprPlusWithHex", "is_valid": "yes", "groups": [ { "virtual_table": "HTTP_SIGNATURE", "group_name": "156_expr_group", "group_id": 56, "regions": [ { "table_name": "HTTP_SIGNATURE", "table_type": "expr_plus", "table_content": { "district": "Content-Type", "keywords": "2f68746d6c", "expr_type": "none", "match_method": "sub", "format": "hexbin" } } ] } ] }, { "compile_id": 157, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "StringScan.StreamScanUTF8", "is_valid": "yes", "groups": [ { "virtual_table": "TROJAN_PAYLOAD", "group_name": "157_expr_group", "group_id": 57, "regions": [ { "table_type": "expr", "table_name": "TROJAN_PAYLOAD", "table_content": { "keywords": "我的订单", "expr_type": "none", "format": "none", "match_method": "sub" } } ] } ] }, { "compile_id": 158, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "IPScan.IPv4_CIDR", "is_valid": "yes", "groups": [ { "virtual_table": "IP_PLUS_CONFIG", "group_name": "158_IP_group", "group_id": 58, "regions": [ { "table_type": "ip_plus", "table_name": "IP_PLUS_CONFIG", "table_content": { "addr_type": "ipv4", "addr_format": "CIDR", "ip1": "192.168.0.1", "ip2": "32", "port_format": "range", "port1": "5210", "port2": "5211", "protocol": 6 } } ] } ] }, { "compile_id": 159, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "IPScan.IPv6_CIDR", "is_valid": "yes", "groups": [ { "virtual_table": "IP_PLUS_CONFIG", "group_name": "159_IP_group", "group_id": 59, "regions": [ { "table_type": "ip_plus", "table_name": "IP_PLUS_CONFIG", "table_content": { "addr_type": "ipv6", "addr_format": "CIDR", "ip1": "2001:db8::", "ip2": "120", "port_format": "range", "port1": "65510", "port2": "65520", "protocol": 6 } } ] } ] }, { "compile_id": 160, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "VirtualWithOnePhysical", "is_valid": "yes", "groups": [ { "virtual_table": "HTTP_RESPONSE_KEYWORDS", "group_name": "TakeMeHome", "not_flag": 0 }, { "virtual_table": "HTTP_URL", "group_name": "160_url_group", "group_id": 60, "not_flag": 0, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "https://blog.csdn.net/littlefang/article/details/8213058", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 161, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "virtual_table_test_temp", "is_valid": "yes", "groups": [ { "virtual_table": "HTTP_SIGNATURE", "group_name": "vt_grp_http_sig1", "group_id": 61, "not_flag": 0, "regions": [ { "table_name": "HTTP_SIGNATURE", "table_type": "expr_plus", "table_content": { "district": "User-Agent", "keywords": "Chrome/78.0.3904.108", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "virtual_table": "HTTP_SIGNATURE", "group_name": "vt_grp_http_sig2", "group_id": 62, "not_flag": 0, "regions": [ { "table_name": "HTTP_SIGNATURE", "table_type": "expr_plus", "table_content": { "district": "Cookie", "keywords": "uid=12345678", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } }, { "table_name": "HTTP_SIGNATURE", "table_type": "expr_plus", "table_content": { "district": "Cookie", "keywords": "sessionid=888888", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 162, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "VirtualWithVirtual", "is_valid": "yes", "groups": [ { "virtual_table": "HTTP_REQUEST_HEADER", "group_name": "vt_grp_http_sig1", "not_flag": 0 }, { "virtual_table": "HTTP_RESPONSE_HEADER", "group_name": "vt_grp_http_sig2", "not_flag": 0 } ] }, { "compile_id": 163, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "OneGroupInTwoVirtual", "is_valid": "yes", "groups": [ { "virtual_table": "HTTP_REQUEST_HEADER", "group_name": "vt_grp_http_sig2", "not_flag": 0 }, { "virtual_table": "HTTP_RESPONSE_HEADER", "group_name": "vt_grp_http_sig2", "not_flag": 0 } ] }, { "compile_id": 164, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "CharsetWindows1251", "is_valid": "yes", "groups": [ { "virtual_table": "KEYWORDS_TABLE", "group_name": "164_keywords_group", "group_id": 63, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": ">ЗАО\\b«Севергазвтоматика\\bАйС»<", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 165, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "EvaluationOrder", "is_valid": "yes", "evaluation_order": "2.111", "groups": [ { "virtual_table": "HTTP_URL", "group_name": "165_url_group", "group_id": 64, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "cavemancircus.com/", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "virtual_table": "IP_PLUS_CONFIG", "group_name": "165_IP_group", "group_id": 65, "not_flag": 0, "regions": [ { "table_type": "ip_plus", "table_name": "IP_PLUS_CONFIG", "table_content": { "addr_type": "ipv4", "addr_format": "CIDR", "ip1": "192.168.23.1", "ip2": "24", "port_format": "range", "port1": "65530", "port2": "65535", "protocol": -1 } } ] } ] }, { "compile_id": 166, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "EvaluationOrder", "is_valid": "yes", "evaluation_order": "100.233", "groups": [ { "virtual_table": "HTTP_URL", "group_name": "166_url_group", "group_id": 66, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "2019/12/27/pretty-girls-6", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 167, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "EvaluationOrder", "is_valid": "yes", "evaluation_order": "300.999", "groups": [ { "virtual_table": "HTTP_URL", "group_name": "167_url_group", "group_id": 67, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "2019/12/27", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 168, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "EvaluationOrder", "is_valid": "yes", "evaluation_order": "0", "groups": [ { "virtual_table": "HTTP_URL", "group_name": "168_url_group", "group_id": 68, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "2019/12/27", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 169, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "IPScan.IPv4_Any", "is_valid": "yes", "groups": [ { "virtual_table": "IP_PLUS_CONFIG", "group_name": "169_IP_group", "group_id": 69, "not_flag" : 0, "regions": [ { "table_type": "ip_plus", "table_name": "IP_PLUS_CONFIG", "table_content": { "addr_type": "ipv4", "addr_format": "CIDR", "ip1": "0.0.0.0", "ip2": "0", "port_format": "range", "port1": "64000", "port2": "64999", "protocol": 6 } } ] } ] }, { "compile_id": 170, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "IPScan.IPv4_virtual.source", "is_valid": "no", "groups": [ { "virtual_table": "IP_PLUS_CONFIG", "group_name": "ipv4_virtual.source", "group_id": 70, "not_flag": 0, "regions": [ { "table_type": "ip_plus", "table_name": "IP_PLUS_CONFIG", "table_content": { "addr_type": "ipv4", "addr_format": "CIDR", "ip1": "192.168.40.10", "ip2": "32", "port_format": "range", "port1": "65531", "port2": "65535", "protocol": 6 } } ] } ] }, { "compile_id": 171, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "IPScan.IPv4_virtual.destination", "is_valid": "no", "groups": [ { "virtual_table": "IP_PLUS_CONFIG", "group_name": "ipv4_virtual.destination", "group_id": 71, "not_flag": 0, "regions": [ { "table_type": "ip_plus", "table_name": "IP_PLUS_CONFIG", "table_content": { "addr_type": "ipv4", "addr_format": "CIDR", "ip1": "192.168.231.46", "ip2": "32", "port_format": "range", "port1": "65532", "port2": "65535", "protocol": 6 } } ] } ] }, { "compile_id": 172, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "ipv4_virtual.match", "is_valid": "yes", "groups": [ { "virtual_table": "VIRTUAL_IP_PLUS_SOURCE", "group_name": "ipv4_virtual.source", "not_flag": 0 }, { "virtual_table": "VIRTUAL_IP_PLUS_DESTINATION", "group_name": "ipv4_virtual.destination", "not_flag": 0 } ] }, { "compile_id": 173, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "IPScan.IPv4_composition.source", "is_valid": "no", "groups": [ { "virtual_table": "IP_PLUS_CONFIG", "group_name": "ipv4_composition.source", "group_id": 72, "not_flag": 0, "regions": [ { "table_type": "ip_plus", "table_name": "IP_PLUS_CONFIG", "table_content": { "addr_type": "ipv4", "addr_format": "CIDR", "ip1": "192.168.40.11", "ip2": "32", "port_format": "range", "port1": "65530", "port2": "65535", "protocol": 6 } } ] } ] }, { "compile_id": 174, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "IPScan.IPv4_composition.destination", "is_valid": "no", "groups": [ { "virtual_table": "IP_PLUS_CONFIG", "group_name": "ipv4_composition.destination", "group_id": 73, "not_flag": 0, "regions": [ { "table_type": "ip_plus", "table_name": "IP_PLUS_CONFIG", "table_content": { "addr_type": "ipv4", "addr_format": "CIDR", "ip1": "192.168.231.47", "ip2": "32", "port_format": "range", "port1": "65530", "port2": "65535", "protocol": 6 } } ] } ] }, { "compile_id": 176, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "IPScan.IPv4_composition.session", "is_valid": "no", "groups": [ { "virtual_table": "IP_PLUS_CONFIG", "group_name": "ipv4_composition.session", "group_id": 74, "not_flag": 0, "regions": [ { "table_type": "ip_plus", "table_name": "IP_PLUS_CONFIG", "table_content": { "addr_type": "ipv4", "addr_format": "CIDR", "ip1": "192.168.40.11", "ip2": "2", "port_format": "range", "port1": "65530", "port2": "65535", "protocol": 6 } } ] } ] }, { "compile_id": 178, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "Hierarchy.TwoVirtualInOneClause", "is_valid": "yes", "groups": [ { "virtual_table": "SOURCE_IP_ASN", "group_name": "ASN1234", "not_flag": 0, "clause_index": 0 }, { "virtual_table": "IP_CONFIG", "group_name": "financial-department-ip", "not_flag": 0, "clause_index": 0 }, { "virtual_table": "SOURCE_IP_GEO", "group_name": "Country-Sparta-IP", "not_flag": 0, "clause_index": 0 }, { "virtual_table": "DESTINATION_IP_ASN", "group_name": "ASN2345", "not_flag": 0, "clause_index": 1 } ] }, { "compile_id": 179, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "anything", "is_valid": "yes", "groups": [ { "virtual_table": "INTERGER_PLUS", "group_name": "179_interval_group", "group_id": 75, "regions": [ { "table_name": "INTERGER_PLUS", "table_type": "interval_plus", "table_content": { "district": "interval.plus", "low_boundary": 2020, "up_boundary": 2020 } } ] } ] }, { "compile_id": 182, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "8-expr", "is_valid": "yes", "groups": [ { "virtual_table": "KEYWORDS_TABLE", "group_name": "182_keywords_group", "group_id": 76, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": "string1&string2&string3&string4&string5&string6&string7&string8", "expr_type": "and", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 183, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "StringScan.RegexWithNotContains", "is_valid": "yes", "groups": [ { "virtual_table": "CORNER_CASE_TABLE", "group_name": "183_expr_group", "group_id": 77, "regions": [ { "table_name": "CORNER_CASE_TABLE", "table_type": "expr", "table_content": { "keywords": "^(?=.*/rain/a/TWF2021042600418000)(?!new.qq.com).*", "expr_type": "regex", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 184, "user_region": "APP_ID=6006740;Liumengyan-Bugreport-20210515", "description": "Hulu", "is_valid": "yes", "do_blacklist": 0, "do_log": 0, "action": 0, "service": 0, "groups": [ { "virtual_table": "IP_CONFIG", "group_name": "184_IP_group", "group_id": 78, "regions": [ { "table_name": "IP_CONFIG", "table_type": "ip_plus", "table_content": { "addr_type": "ipv6", "addr_format": "mask", "ip1": "::", "ip2": "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff", "port_format": "single", "port1": "0", "port2": "0", "protocol": 0 } } ] } ] }, { "compile_id": 186, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "NOTLogic.ScanHitAtLast", "is_valid": "yes", "groups": [ { "virtual_table": "HTTP_URL_FILTER", "group_name": "186_expr_group", "group_id": 79, "not_flag": 1, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "must-not-contained-string-of-rule-186", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "virtual_table": "IP_PLUS_CONFIG", "group_name": "186_IP_group", "group_id": 80, "not_flag": 0, "regions": [ { "table_type": "ip_plus", "table_name": "IP_PLUS_CONFIG", "table_content": { "addr_type": "ipv4", "addr_format": "single", "ip1": "10.0.8.186", "ip2": "10.0.8.186", "port_format": "single", "port1": "18611", "port2": "18611", "protocol": 6 } } ] } ] }, { "compile_id": 187, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "NOTLogic.ScanHitAtLast", "is_valid": "yes", "groups": [ { "virtual_table": "HTTP_URL_FILTER", "group_name": "187_url_group", "group_id": 81, "not_flag": 1, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "must-not-contained-string-of-rule-187", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "virtual_table": "IP_PLUS_CONFIG", "group_name": "187_IP_group", "group_id": 82, "not_flag": 0, "regions": [ { "table_type": "ip_plus", "table_name": "IP_PLUS_CONFIG", "table_content": { "addr_type": "ipv4", "addr_format": "single", "ip1": "10.0.8.187", "ip2": "10.0.8.187", "port_format": "single", "port1": "18611", "port2": "18611", "protocol": 6 } } ] } ] }, { "compile_id": 188, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "NOTLogic.ScanHitAtLast", "is_valid": "yes", "groups": [ { "virtual_table": "HTTP_URL_FILTER", "group_name": "188_url_group", "group_id": 83, "not_flag": 1, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "must-not-contained-string-of-rule-188", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "virtual_table": "IP_PLUS_CONFIG", "group_name": "188_IP_group", "group_id": 84, "not_flag": 0, "regions": [ { "table_type": "ip_plus", "table_name": "IP_PLUS_CONFIG", "table_content": { "addr_type": "ipv4", "addr_format": "single", "ip1": "10.0.8.188", "ip2": "10.0.8.188", "port_format": "single", "port1": "18611", "port2": "18611", "protocol": 6 } } ] } ] }, { "compile_id": 189, "is_valid": "yes", "do_log": 0, "action": 0, "service": 0, "do_blacklist": 0, "user_region": "StringScan.ShouldNotHitExprPlus", "groups": [ { "virtual_table": "APP_PAYLOAD", "group_name": "189_app_group", "group_id": 85, "regions": [ { "table_name": "APP_PAYLOAD", "table_content": { "format": "hexbin", "match_method": "sub", "district": "tcp.payload.c2s_first_data", "keywords": "ab00", "expr_type": "none" }, "table_type": "expr_plus" } ] } ] }, { "compile_id": 190, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "StringScan.ExprPlus", "is_valid": "yes", "groups": [ { "virtual_table": "HTTP_SIGNATURE", "group_name": "190_expr_group", "group_id": 86, "regions": [ { "table_name": "HTTP_SIGNATURE", "table_type": "expr_plus", "table_content": { "district": "我的DistrIct", "keywords": "addis&sapphire", "expr_type": "and", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 191, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "StringScan.HexBinCaseSensitive", "is_valid": "yes", "groups": [ { "virtual_table": "KEYWORDS_TABLE", "group_name": "191_keywords_group", "group_id": 87, "regions": [ { "table_type": "expr", "table_name": "KEYWORDS_TABLE", "table_content": { "keywords": "54455354", "expr_type": "none", "format": "hexbin", "match_method": "sub" } } ] } ] }, { "compile_id": 192, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "anything", "is_valid": "yes", "groups": [ { "virtual_table": "FLAG_CONFIG", "group_name": "192_flag_group", "group_id": 88, "regions": [ { "table_type": "flag", "table_name": "FLAG_CONFIG", "table_content": { "flag": 1, "flag_mask": 3 } } ] } ] }, { "compile_id": 193, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "anything", "is_valid": "yes", "groups": [ { "virtual_table": "FLAG_CONFIG", "group_name": "193_flag_group", "group_id": 89, "regions": [ { "table_type": "flag", "table_name": "FLAG_CONFIG", "table_content": { "flag": 2, "flag_mask": 3 } } ] }, { "virtual_table": "HTTP_URL", "group_name": "193_url_group", "group_id": 90, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "hello", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 194, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "anything", "is_valid": "yes", "groups": [ { "virtual_table": "FLAG_CONFIG", "group_name": "194_flag_group", "group_id": 91, "regions": [ { "table_type": "flag", "table_name": "FLAG_CONFIG", "table_content": { "flag": 21, "flag_mask": 31 } } ] } ] }, { "compile_id": 195, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "anything", "is_valid": "yes", "groups": [ { "virtual_table": "HTTP_SIGNATURE", "group_name": "195_signature_group", "group_id": 92, "regions": [ { "table_name": "HTTP_SIGNATURE", "table_type": "expr_plus", "table_content": { "district": "I love China", "keywords": "today&yesterday", "expr_type": "and", "match_method": "sub", "format": "uncase plain" } } ] }, { "virtual_table": "HTTP_URL", "group_name": "195_url_group", "group_id": 93, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "Monday", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 196, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "anything", "is_valid": "yes", "groups": [ { "virtual_table": "FLAG_PLUS_CONFIG", "group_name": "196_flag_group", "group_id": 94, "regions": [ { "table_type": "flag_plus", "table_name": "FLAG_PLUS_CONFIG", "table_content": { "district": "I love\\bChina", "flag": 30, "flag_mask": 14 } } ] } ] }, { "compile_id": 197, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "Something:I\\bhave\\ba\\bname,8866", "is_valid": "yes", "groups": [ { "virtual_table": "HTTP_URL", "group_name": "197_url_group", "group_id": 95, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "hqdefault.jpg", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 198, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "Something:I\\bhave\\ba\\bname,7799", "compile_table_name": "COMPILE_FIREWALL_DEFAULT", "is_valid": "yes", "groups": [ { "g2c_table_name": "GROUP2COMPILE_FIREWALL", "virtual_table": "HTTP_URL", "group_name": "198_url_group", "group_id": 96, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "firewall", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 199, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "ExcludeLogic.ScanNotAtLast", "is_valid": "yes", "groups": [ { "virtual_table": "HTTP_URL", "group_name": "ExcludeLogicGroup199", "group_id": 97, "sub_groups":[ { "group_name": "ExcludeLogicGroup199_1", "group_id": 98, "is_exclude": 0, "clause_index": 0, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "must-contained-string-of-rule-199", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "group_name": "ExcludeLogicGroup199_2", "group_id": 99, "is_exclude": 1, "clause_index": 0, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "must-not-contained-string-of-rule-199", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] } ] } ] }, { "compile_id": 200, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "ExcludeLogic.OneRegion", "is_valid": "yes", "groups": [ { "virtual_table": "HTTP_URL", "group_name": "ExcludeLogicGroup200", "group_id": 100, "sub_groups":[ { "virtual_table": "HTTP_URL", "group_name": "ExcludeLogicGroup200_1", "group_id": 101, "is_exclude": 0, "clause_index": 0, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "must-contained-string-of-rule-200", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "virtual_table": "HTTP_URL", "group_name": "ExcludeLogicGroup200_2", "group_id": 102, "is_exclude": 1, "clause_index": 0, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "must-not-contained-string-of-rule-200", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] } ] } ] }, { "compile_id": 202, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "null", "is_valid": "yes", "groups": [ { "virtual_table": "VIRTUAL_IP_PLUS_TABLE", "group_name": "ExcludeLogicGroup202", "group_id": 103, "clause_index": 0, "sub_groups":[ { "group_name": "ExcludeLogicGroup202_1", "group_id": 104, "is_exclude": 0, "regions": [ { "table_type": "ip_plus", "table_name": "IP_PLUS_CONFIG", "table_content": { "addr_type": "ipv4", "addr_format": "range", "ip1": "100.64.1.0", "ip2": "100.64.1.20", "port_format": "range", "port1": "5210", "port2": "5211", "protocol": 6 } } ] }, { "group_name": "ExcludeLogicGroup202_2", "group_id": 105, "is_exclude": 1, "regions": [ { "table_type": "ip_plus", "table_name": "IP_PLUS_CONFIG", "table_content": { "addr_type": "ipv4", "addr_format": "range", "ip1": "100.64.1.6", "ip2": "100.64.1.10", "port_format": "range", "port1": "5210", "port2": "5211", "protocol": 6 } } ] }, { "group_name": "ExcludeLogicGroup202_3", "group_id": 106, "is_exclude": 1, "regions": [ { "table_type": "ip_plus", "table_name": "IP_PLUS_CONFIG", "table_content": { "addr_type": "ipv4", "addr_format": "range", "ip1": "100.64.1.11", "ip2": "100.64.1.20", "port_format": "range", "port1": "5210", "port2": "5211", "protocol": 6 } } ] } ] } ] }, { "compile_id": 203, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "null", "is_valid": "yes", "groups": [ { "virtual_table": "VIRTUAL_IP_PLUS_SOURCE", "group_name": "ExcludeLogicGroup203_1", "group_id": 107, "clause_index": 0, "regions": [ { "table_name": "IP_PLUS_CONFIG", "table_type": "ip_plus", "table_content": { "addr_type": "ipv4", "addr_format": "range", "ip1": "192.168.50.43", "ip2": "192.168.50.43", "port_format": "range", "port1": "56168", "port2": "56168", "protocol": -1, "direction": "double" } } ] }, { "virtual_table": "VIRTUAL_IP_PLUS_DESTINATION", "group_name": "ExcludeLogicGroup203_2", "group_id": 108, "clause_index": 1, "regions": [ { "table_name": "IP_PLUS_CONFIG", "table_type": "ip_plus", "table_content": { "addr_type": "ipv4", "addr_format": "range", "ip1": "47.92.108.93", "ip2": "47.92.108.93", "port_format": "range", "port1": "443", "port2": "443", "protocol": -1, "direction": "double" } } ] }, { "virtual_table": "HTTP_RESPONSE_KEYWORDS", "group_name": "ExcludeLogicGroup203_3", "group_id": 109, "clause_index": 2, "sub_groups": [ { "group_name": "ExcludeLogicGroup203_3_1", "group_id": 110, "is_exclude": 0, "regions": [ { "table_type":"expr", "table_name":"KEYWORDS_TABLE", "table_content":{ "format":"uncase plain", "match_method":"suffix", "keywords":"jianshu.com", "expr_type":"none" } } ] }, { "group_name": "ExcludeLogicGroup203_3_2", "group_id": 111, "is_exclude": 1, "regions": [ { "table_type":"expr", "table_name":"KEYWORDS_TABLE", "table_content":{ "format":"uncase plain", "match_method":"complete", "keywords":"www.jianshu.com", "expr_type":"none" } } ] } ] } ] }, { "compile_id": 204, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "null", "is_valid": "yes", "groups": [ { "virtual_table": "VIRTUAL_IP_PLUS_SOURCE", "group_name": "ExcludeLogicGroup204_1", "group_id": 112, "clause_index": 0, "regions": [ { "table_name": "IP_PLUS_CONFIG", "table_type": "ip_plus", "table_content": { "addr_type": "ipv4", "addr_format": "range", "ip1": "100.64.2.0", "ip2": "100.64.2.5", "port_format": "range", "port1": "56168", "port2": "56168", "protocol": -1, "direction": "double" } } ] }, { "virtual_table": "VIRTUAL_IP_PLUS_DESTINATION", "group_name": "ExcludeLogicGroup204_2", "group_id": 113, "clause_index": 1, "regions": [ { "table_name": "IP_PLUS_CONFIG", "table_type": "ip_plus", "table_content": { "addr_type": "ipv4", "addr_format": "range", "ip1": "100.64.2.6", "ip2": "100.64.2.10", "port_format": "range", "port1": "443", "port2": "443", "protocol": -1, "direction": "double" } } ] }, { "virtual_table": "HTTP_RESPONSE_KEYWORDS", "group_name": "ExcludeLogicGroup204_3", "group_id": 114, "clause_index": 2, "sub_groups": [ { "group_name": "ExcludeLogicGroup204_3_1", "group_id": 115, "is_exclude": 0, "sub_groups" : [ { "group_name": "ExcludeLogicGroup204_3_1_1", "group_id": 116, "is_exclude": 0, "regions": [ { "table_type":"expr", "table_name":"KEYWORDS_TABLE", "table_content":{ "format":"uncase plain", "match_method":"suffix", "keywords":"baidu.com", "expr_type":"none" } } ] }, { "group_name": "ExcludeLogicGroup204_3_1_2", "group_id": 117, "is_exclude": 1, "regions": [ { "table_type":"expr", "table_name":"KEYWORDS_TABLE", "table_content":{ "format":"uncase plain", "match_method":"complete", "keywords":"www.baidu.com", "expr_type":"none" } } ] } ] }, { "group_name": "ExcludeLogicGroup204_3_2", "group_id": 118, "is_exclude": 1, "regions": [ { "table_type":"expr", "table_name":"KEYWORDS_TABLE", "table_content":{ "format":"uncase plain", "match_method":"complete", "keywords":"mail.baidu.com", "expr_type":"none" } } ] } ] } ] }, { "compile_id": 205, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "StringScan.RegexExpressionIllegal", "is_valid": "yes", "groups": [ { "virtual_table": "KEYWORDS_TABLE", "group_name": "205_keywords_group", "group_id": 119, "regions": [ { "table_type": "expr", "table_name": "KEYWORDS_TABLE", "table_content": { "keywords": "123^456", "expr_type": "regex", "format": "uncase plain", "match_method": "sub" } } ] } ] }, { "compile_id": 206, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "duplicateRuleFor191", "is_valid": "yes", "groups": [ { "virtual_table": "KEYWORDS_TABLE", "group_name": "206_keywords_group", "group_id": 120, "regions": [ { "table_type": "expr", "table_name": "KEYWORDS_TABLE", "table_content": { "keywords": "54455354", "expr_type": "none", "format": "hexbin", "match_method": "sub" } } ] } ] }, { "compile_id": 207, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "duplicateRuleFor192", "is_valid": "yes", "groups": [ { "virtual_table": "FLAG_CONFIG", "group_name": "207_flag_group", "group_id": 121, "regions": [ { "table_type": "flag", "table_name": "FLAG_CONFIG", "table_content": { "flag": 1, "flag_mask": 3 } } ] } ] }, { "compile_id": 208, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "duplicateRuleFor154", "is_valid": "yes", "groups": [ { "virtual_table": "IP_PLUS_CONFIG", "group_name": "208_IP_group", "group_id": 122, "not_flag": 0, "regions": [ { "table_type": "ip_plus", "table_name": "IP_PLUS_CONFIG", "table_content": { "addr_type": "ipv4", "addr_format": "range", "ip1": "10.0.7.100", "ip2": "10.0.7.106", "port_format": "range", "port1": "65530", "port2": "65535", "protocol": 6 } } ] } ] }, { "compile_id": 209, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "duplicateRuleFor179", "is_valid": "yes", "groups": [ { "virtual_table": "INTERGER_PLUS", "group_name": "209_interval_group", "group_id": 123, "regions": [ { "table_name": "INTERGER_PLUS", "table_type": "interval_plus", "table_content": { "district": "interval.plus", "low_boundary": 2020, "up_boundary": 2020 } } ] } ] }, { "compile_id": 210, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "ipv6_::", "is_valid": "yes", "groups": [ { "virtual_table": "IP_PLUS_CONFIG", "group_name": "210_IP_group", "group_id": 124, "regions": [ { "table_type": "ip_plus", "table_name": "IP_PLUS_CONFIG", "table_content": { "addr_type": "ipv6", "addr_format": "CIDR", "ip1": "::", "ip2": "0", "port_format": "range", "port1": "64000", "port2": "64999", "protocol": 6 } } ] } ] }, { "compile_id": 211, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "ip_perf_test", "is_valid": "yes", "groups": [ { "virtual_table": "IP_PERF_CONFIG", "group_name": "211_IP_group", "group_id": 125, "not_flag": 0, "regions": [ { "table_type": "ip_plus", "table_name": "IP_PERF_CONFIG", "table_content": { "addr_type": "ipv4", "addr_format": "range", "ip1": "10.0.0.1", "ip2": "10.0.0.6", "port_format": "range", "port1": "65530", "port2": "65535", "protocol": 6 } } ] } ] }, { "compile_id": 212, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "integer_perf_test", "is_valid": "yes", "groups": [ { "virtual_table": "INTEGER_PERF_CONFIG", "group_name": "212_interval_group", "group_id": 126, "regions": [ { "table_name": "INTEGER_PERF_CONFIG", "table_type": "interval", "table_content": { "low_boundary": 3000, "up_boundary": 3000 } } ] } ] }, { "compile_id": 213, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "expr_perf_test", "is_valid": "yes", "groups": [ { "virtual_table": "EXPR_LITERAL_PERF_CONFIG", "group_name": "213_expr_group", "group_id": 127, "regions": [ { "table_name": "EXPR_LITERAL_PERF_CONFIG", "table_type": "expr", "table_content": { "keywords": "today&yesterday", "expr_type": "and", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 214, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "flag_perf_test", "is_valid": "yes", "groups": [ { "virtual_table": "FLAG_PERF_CONFIG", "group_name": "214_flag_group", "group_id": 128, "regions": [ { "table_type": "flag", "table_name": "FLAG_PERF_CONFIG", "table_content": { "flag": 15, "flag_mask": 15 } } ] } ] }, { "compile_id": 215, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "expr_perf_test", "is_valid": "yes", "groups": [ { "virtual_table": "EXPR_REGEX_PERF_CONFIG", "group_name": "215_expr_group", "group_id": 129, "regions": [ { "table_name": "EXPR_REGEX_PERF_CONFIG", "table_type": "expr", "table_content": { "keywords": "action=search\\&query=(.*)", "expr_type": "regex", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 216, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "NOTClause&ExcludeGroup", "is_valid": "yes", "groups": [ { "virtual_table": "HTTP_URL_FILTER", "group_name": "ExcludeLogicGroup200", "not_flag": 0, "clause_index": 0 }, { "virtual_table": "HTTP_RESPONSE_KEYWORDS", "group_name": "NOTClauseAndExcludeGroup216", "group_id": 130, "not_flag": 1, "clause_index": 1, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": "keywords-for-compile-211", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 217, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "NOTClause&ExcludeGroup", "is_valid": "yes", "groups": [ { "virtual_table": "HTTP_URL_FILTER", "group_name": "NOTClauseAndExcludeGroup217_1", "group_id": 131, "not_flag": 1, "clause_index": 0, "sub_groups": [ { "group_name": "ExcludeLogicGroup217_1_1", "group_id": 132, "is_exclude": 0, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "string-of-rule-217.com", "expr_type": "none", "match_method": "suffix", "format": "uncase plain" } } ] }, { "group_name": "ExcludeLogicGroup217_1_2", "group_id": 133, "is_exclude": 1, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "www.string-of-rule-217.com", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "virtual_table": "HTTP_RESPONSE_KEYWORDS", "group_name": "NOTClauseAndExcludeGroup217_2", "group_id": 134, "not_flag": 0, "clause_index": 1, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": "keywords-for-compile-217", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 218, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "anything", "is_valid": "yes", "groups": [ { "virtual_table": "CONTENT_SIZE", "group_name": "218_interval_group", "group_id": 135, "regions": [ { "table_name": "CONTENT_SIZE", "table_type": "interval", "table_content": { "low_boundary": 3000, "up_boundary": 3000 } } ] } ] }, { "compile_id": 219, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "anything", "is_valid": "yes", "groups": [ { "virtual_table": "HTTP_DUMMY", "group_name": "NOTClauseAndExcludeGroup219_1", "group_id": 136, "not_flag": 0, "clause_index": 0, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": "keywords-dummy-219-1", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "virtual_table": "HTTP_DUMMY", "group_name": "NOTClauseAndExcludeGroup219_2", "group_id": 137, "not_flag": 1, "clause_index": 1, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": "keywords-dummy-219-2", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "virtual_table": "HTTP_DUMMY", "group_name": "NOTClauseAndExcludeGroup219_3", "group_id": 138, "not_flag": 1, "clause_index": 2, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": "keywords-dummy-219-3", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "virtual_table": "HTTP_DUMMY", "group_name": "NOTClauseAndExcludeGroup219_4", "group_id": 139, "not_flag": 1, "clause_index": 3, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": "keywords-dummy-219-4", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "virtual_table": "HTTP_DUMMY", "group_name": "NOTClauseAndExcludeGroup219_5", "group_id": 140, "not_flag": 1, "clause_index": 4, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": "keywords-dummy-219-5", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "virtual_table": "HTTP_DUMMY", "group_name": "NOTClauseAndExcludeGroup219_6", "group_id": 141, "not_flag": 1, "clause_index": 5, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": "keywords-dummy-219-6", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "virtual_table": "HTTP_DUMMY", "group_name": "NOTClauseAndExcludeGroup219_7", "group_id": 142, "not_flag": 1, "clause_index": 6, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": "keywords-dummy-219-7", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "virtual_table": "HTTP_DUMMY", "group_name": "NOTClauseAndExcludeGroup219_8", "group_id": 143, "not_flag": 1, "clause_index": 7, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": "keywords-dummy-219-8", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 220, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "anything", "is_valid": "yes", "groups": [ { "virtual_table": "HTTP_DUMMY", "group_name": "NOTClauseAndExcludeGroup220_1", "group_id": 144, "not_flag": 0, "clause_index": 0, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": "keywords-dummy-220-1", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "virtual_table": "HTTP_DUMMY", "group_name": "NOTClauseAndExcludeGroup220_2", "group_id": 145, "not_flag": 1, "clause_index": 1, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": "keywords-dummy-220-2", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "virtual_table": "HTTP_DUMMY", "group_name": "NOTClauseAndExcludeGroup220_3", "group_id": 146, "not_flag": 1, "clause_index": 2, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": "keywords-dummy-220-3", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 221, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "NOTLogic.ScanWithDistrict", "is_valid": "yes", "groups": [ { "virtual_table": "HTTP_REQUEST_HEADER", "group_name": "NOTLogicGroup_221_1", "group_id": 147, "not_flag": 1, "regions": [ { "table_name": "HTTP_SIGNATURE", "table_type": "expr_plus", "table_content": { "district": "User-Agent", "keywords": "Mozilla/5.0", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "virtual_table": "HTTP_URL", "group_name": "NOTLogicGroup_221_2", "group_id": 148, "not_flag": 0, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "scan_with_district_221", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 222, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "NOTLogic.SameClauseHasMultiNotGroups", "is_valid": "yes", "groups": [ { "virtual_table": "HTTP_URL_FILTER", "group_name": "NOTLogicGroup_222_1", "group_id": 149, "clause_index": 0, "not_flag": 1, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "not_logic_compile_222_1", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "virtual_table": "HTTP_URL_FILTER", "group_name": "NOTLogicGroup_222_2", "group_id": 150, "clause_index": 0, "not_flag": 1, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "not_logic_compile_222_2", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "virtual_table": "HTTP_URL_FILTER", "group_name": "NOTLogicGroup_222_3", "group_id": 151, "clause_index": 1, "not_flag": 0, "regions": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "keywords": "logic_compile_222_3", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 223, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "NOTLogic.MultiNotClause", "is_valid": "yes", "groups": [ { "virtual_table": "HTTP_NOT_LOGIC", "group_name": "NOTLogicGroup_223_1", "group_id": 152, "not_flag": 1, "clause_index": 0, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": "not_logic_compile_223_1", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "virtual_table": "HTTP_NOT_LOGIC", "group_name": "NOTLogicGroup_223_2", "group_id": 153, "not_flag": 1, "clause_index": 1, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": "not_logic_compile_223_2", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "virtual_table": "HTTP_NOT_LOGIC", "group_name": "NOTLogicGroup_223_1", "group_id": 154, "not_flag": 1, "clause_index": 2, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": "not_logic_compile_223_3", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 224, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "NOTLogic.NotPhysicalTable", "is_valid": "yes", "groups": [ { "virtual_table": "KEYWORDS_TABLE", "group_name": "NOTLogicGroup_224_1", "group_id": 155, "not_flag": 1, "clause_index": 0, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": "not_logic_compile_224_1", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "virtual_table": "HTTP_RESPONSE_KEYWORDS", "group_name": "NOTLogicGroup_224_2", "group_id": 156, "not_flag": 0, "clause_index": 1, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": "not_logic_compile_224_2", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 225, "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "user_region": "Payload escape", "is_valid": "yes", "groups": [ { "virtual_table": "KEYWORDS_TABLE", "group_name": "EscapeGroup_225_1", "group_id": 157, "not_flag": 0, "clause_index": 0, "regions": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "keywords": "GET\\b/\\bHTTP/1.1\\r\\nHost:\\bwww.baidu.com\\r\\n\\r\\n", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 226, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "maat_scan_group", "is_valid": "yes", "groups": [ { "virtual_table": "KEYWORDS_TABLE", "group_name": "226_url_group", "group_id": 158 } ] }, { "compile_id": 227, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "maat_scan_group", "compile_table_name": "COMPILE_FIREWALL_DEFAULT", "is_valid": "yes", "groups": [ { "virtual_table": "KEYWORDS_TABLE", "group_name": "227_url_group", "group_id": 159, "g2c_table_name": "GROUP2COMPILE_FIREWALL" } ] } ], "plugin_table": [ { "table_name": "QD_ENTRY_INFO", "table_content": [ "1\t192.168.0.1\t101\t1", "2\t192.168.0.2\t102\t1", "3\t192.168.1.1\t103\t1" ] }, { "table_name": "TEST_PLUGIN_TABLE", "table_content": [ "1\t3388\t99\t1", "2\t3355\t66\t1", "3\tcccc\t11\t1" ] }, { "table_name": "TEST_PLUGIN_EXDATA_TABLE", "table_content": [ "1\tHeBei\tShijiazhuang\t1\t0", "2\tHeNan\tZhengzhou\t1\t0", "3\tShanDong\tJinan\t1\t0", "4\tShanXi\tTaiyuan\t1\t0" ] }, { "table_name": "TEST_EFFECTIVE_RANGE_TABLE", "table_content": [ "1\tSUCCESS\t99\t1\t{\"tag_sets\":[[{\"tag\":\"location\",\"value\":[\"北京/朝阳/华严北里\"]},{\"tag\":\"isp\",\"value\":[\"电信\",\"移动\"]}]]}\t1111", "2\tSUCCESS\t66\t1\t0\t222", "3\tFAILED\t11\t1\t{\"tag_sets\":[[{\"tag\":\"location\",\"value\":[\"北京/朝阳/华严北里\",\"上海/浦东/陆家嘴\"]},{\"tag\":\"isp\",\"value\":[\"电信\",\"联通\"]}],[{\"tag\":\"location\",\"value\":[\"北京\"]},{\"tag\":\"isp\",\"value\":[\"联通\"]}]]}\t333", "4\tSUCCESS\t66\t1\t{}\t444", "5\tSUCCESS\t66\t1\t{\"tag_sets\":[[{\"tag\":\"location\",\"value\":[\"北京\"]}]]}\t444", "6\tSUCCESS\t66\t1\t{\"tag_sets\":[[{\"tag\":\"weather\",\"value\":[\"hot\"]}]]}\t444" ] }, { "table_name": "IR_INTERCEPT_IP", "table_content": [ "1000000130\t1000000130\t4\t192.168.10.99\t255.255.255.255\t0\t65535\t0.0.0.0\t255.255.255.255\t0\t65535\t0\t1\t1\t96\t1\tuser_region\t{}\t2019/1/24/18:0:34", "161\t161\t4\t0.0.0.0\t255.255.255.255\t0\t65535\t61.135.169.121\t255.255.255.255\t0\t65535\t0\t0\t1\t96\t832\t0\t0\t2019/1/24/18:48:42" ] }, { "table_name": "TEST_IP_PLUGIN_WITH_EXDATA", "table_content": [ "101\t4\t192.168.30.99\t192.168.30.101\tSomething-like-json\t1", "102\t4\t192.168.30.90\t192.168.30.128\tBigger-range-should-in-the-back\t1", "103\t6\t2001:db8:1234::\t2001:db8:1235::\tBigger-range-should-in-the-back\t1", "104\t6\t2001:db8:1234::1\t2001:db8:1234::5210\tSomething-like-json\t1", "105\t6\t2620:100:3000::\t2620:0100:30ff:ffff:ffff:ffff:ffff:ffff\tBugreport-liumengyan-20210517\t1" ] }, { "table_name": "TEST_IPPORT_PLUGIN_WITH_EXDATA", "table_content": [ "101\t4\t192.168.100.1\t0\t255\t1", "102\t4\t192.168.100.2\t100\t200\t1", "103\t4\t192.168.100.1\t255\t300\t1", "104\t6\t2001:db8:1234::5210\t255\t512\t1" ] }, { "table_name": "TEST_FQDN_PLUGIN_WITH_EXDATA", "table_content": [ "201\t0\twww.example1.com\tcatid=1\t1", "202\t1\t.example1.com\tcatid=1\t1", "203\t0\tnews.example1.com\tcatid=2\t1", "204\t0\tr3---sn-i3belne6.example2.com\tcatid=3\t1", "205\t0\tr3---sn-i3belne6.example2.com\tcatid=3\t1" ] }, { "table_name": "TEST_BOOL_PLUGIN_WITH_EXDATA", "table_content": [ "301\t1&2&1000\ttunnel1\t1", "302\t101&102\ttunnel2\t1", "303\t102\ttunnel3\t1", "304\t101\ttunnel4\t1", "305\t0&1&2&3&4&5&6&7\ttunnel5\t1", "306\t101&101\tinvalid\t1" ] }, { "table_name": "TEST_PLUGIN_LONG_KEY_TYPE_TABLE", "table_content": [ "1\t11111111\tShijiazhuang\t1\t0", "2\t22222222\tZhengzhou\t1\t0", "3\t33333333\tJinan\t1\t0", "4\t44444444\tTaiyuan\t1\t0" ] }, { "table_name": "TEST_PLUGIN_INT_KEY_TYPE_TABLE", "table_content": [ "1\t101\tChina\t1\t0", "2\t102\tAmerica\t1\t0", "3\t103\tRussia\t1\t0", "4\t104\tJapan\t1\t0" ] }, { "table_name": "TEST_PLUGIN_IP_KEY_TYPE_TABLE", "table_content": [ "4\t100.64.1.1\tXiZang\t1\t0", "4\t100.64.1.2\tXinJiang\t1\t0", "6\t2001:da8:205:1::101\tGuiZhou\t1\t0", "6\t1001:da8:205:1::101\tSiChuan\t1\t0", "7\t100.64.1.3\tQingHai\t1\t0", "6\t100.64.1.4\tGanSu\t1\t0" ] } ] }