{ "rule_table": "RULE_DEFAULT", "object_group_table": "OBJECT_GROUP", "objects": [ { "object_name": "ASN1234", "uuid": "00000000-0000-0000-0000-000000000001", "items": [ { "table_name": "AS_NUMBER", "table_type": "expr", "table_content": { "expression": "^AS1234$", "expr_type": "and" } } ] }, { "object_name": "ASN2345", "uuid": "00000000-0000-0000-0000-000000000002", "items": [ { "table_name": "AS_NUMBER", "table_type": "expr", "table_content": { "expression": "^AS2345$", "expr_type": "and" } } ] }, { "object_name": "ASN6789", "uuid": "00000000-0000-0000-0000-000000000003", "items": [ { "table_name": "AS_NUMBER", "table_type": "expr", "table_content": { "expression": "^AS6789$", "expr_type": "and" } } ] }, { "object_name": "ASN9001", "uuid": "00000000-0000-0000-0000-000000000004", "items": [ { "table_name": "AS_NUMBER", "table_type": "expr", "table_content": { "expression": "^AS9001$", "expr_type": "and" } } ] }, { "object_name": "ASN9002", "uuid": "00000000-0000-0000-0000-000000000005", "items": [ { "table_name": "AS_NUMBER", "table_type": "expr", "table_content": { "expression": "^AS9002$", "expr_type": "and" } } ] }, { "object_name": "ASN9003", "uuid": "00000000-0000-0000-0000-000000000006", "items": [ { "table_name": "AS_NUMBER", "table_type": "expr", "table_content": { "expression": "^AS9003$", "expr_type": "and" } } ] }, { "object_name": "IPv4-composition-source-only", "uuid": "00000000-0000-0000-0000-000000000007", "items": [ { "table_type": "ip", "table_name": "IP_PLUS_CONFIG", "table_content": { "ip": "192.168.50.24" } } ] }, { "object_name": "FQDN_OBJ1", "uuid": "00000000-0000-0000-0000-000000000008", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "^sports.example.com$", "expr_type": "and" } } ] }, { "object_name": "FQDN_CAT1", "uuid": "00000000-0000-0000-0000-000000000009", "items": [ { "table_name": "INTERGER_PLUS", "table_type": "interval", "table_content": { "interval": "1724" } } ] }, { "object_name": "IPv4-composition-NOT-client-ip", "uuid": "00000000-0000-0000-0000-000000000010", "items": [ { "table_type": "ip", "table_name": "IP_PLUS_CONFIG", "table_content": { "ip": "192.168.58.19" } } ] }, { "object_name": "IPv4-composition-NOT-server-ip", "uuid": "00000000-0000-0000-0000-000000000011", "items": [ { "table_type": "ip", "table_name": "IP_PLUS_CONFIG", "table_content": { "ip": "10.0.1.20-10.0.1.25" } } ] }, { "object_name": "financial-department-ip", "uuid": "00000000-0000-0000-0000-000000000012", "items": [ { "table_name": "IP_CONFIG", "table_type": "ip", "table_content": { "ip": "192.168.40.88/32" } } ] }, { "object_name": "security-department-ip", "uuid": "00000000-0000-0000-0000-000000000013", "items": [ { "table_name": "IP_PLUS_CONFIG", "table_type": "ip", "table_content": { "ip": "192.168.40.88/32" } } ] }, { "object_name": "develop-department-ip", "uuid": "00000000-0000-0000-0000-000000000014", "items": [ { "table_name": "IP_PLUS_CONFIG", "table_type": "ip", "table_content": { "ip": "192.168.40.88/32" } } ] }, { "object_name": "Country-Sparta-IP", "uuid": "00000000-0000-0000-0000-000000000015", "items": [ { "table_name": "GeoLocation", "table_type": "expr", "table_content": { "expression": "^Greece.Sparta$", "expr_type": "and" } } ] }, { "object_name": "123_IP_object", "uuid": "00000000-0000-0000-0000-000000000100", "items": [ { "table_name": "IP_CONFIG", "table_type": "ip", "table_content": { "ip": "10.0.6.201/32" } }, { "table_name": "IP_CONFIG", "table_type": "ip", "table_content": { "ip": "2001:da8:205:1::101/112" } } ] }, { "object_name": "126_interval_object", "uuid": "00000000-0000-0000-0000-000000000106", "items": [ { "table_name": "CONTENT_SIZE", "table_type": "interval", "table_content": { "interval": "2014-2016" } } ] }, { "object_name": "TakeMeHome", "uuid": "00000000-0000-0000-0000-000000000111", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "Take me Home&Batman\\", "expr_type": "and" } } ] }, { "object_name": "152_mail_addr", "uuid": "00000000-0000-0000-0000-000000000141", "items": [ { "table_type": "expr", "table_name": "MAIL_ADDR", "table_content": { "expression": "^ceshi3@mailhost.cn", "expr_type": "and" } }, { "table_type": "expr", "table_name": "MAIL_ADDR", "table_content": { "expression": "^ceshi6@mailhost.cn", "expr_type": "and" } } ] }, { "object_name": "153_expr_object", "uuid": "00000000-0000-0000-0000-000000000143", "items": [ { "table_type": "expr", "table_name": "MAIL_ADDR", "table_content": { "expression": "^ceshi4@mailhost.cn", "expr_type": "and" } } ] }, { "object_name": "vt_grp_http_sig1", "uuid": "00000000-0000-0000-0000-000000000152", "items": [ { "table_name": "HTTP_SIGNATURE", "table_type": "expr", "table_content": { "expression": "Chrome/78.0.3904.108", "expr_type": "and" } } ] }, { "object_name": "167_url_object", "uuid": "00000000-0000-0000-0000-000000000158", "items": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "expression": "2019/12/27", "expr_type": "and" } } ] }, { "object_name": "ExcludeLogicObject199_1", "uuid": "00000000-0000-0000-0000-000000000189", "is_exclude": 0, "items": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "expression": "must-contained-string-of-rule-199", "expr_type": "and" } } ] }, { "object_name": "ExcludeLogicObject199_2", "uuid": "00000000-0000-0000-0000-000000000190", "is_exclude": 1, "items": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "expression": "must-not-contained-string-of-rule-199", "expr_type": "and" } } ] }, { "object_name": "ExcludeLogicObject200_1", "uuid": "00000000-0000-0000-0000-000000000192", "is_exclude": 0, "items": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "expression": "must-contained-string-of-rule-200", "expr_type": "and" } } ] }, { "object_name": "ExcludeLogicObject200_2", "uuid": "00000000-0000-0000-0000-000000000193", "is_exclude": 1, "items": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "expression": "must-not-contained-string-of-rule-200", "expr_type": "and" } } ] }, { "object_name": "ExcludeLogicObject202_1", "uuid": "00000000-0000-0000-0000-000000000195", "is_exclude": 0, "items": [ { "table_type": "ip", "table_name": "IP_PLUS_CONFIG", "table_content": { "ip": "100.64.1.0-100.64.1.20" } } ] }, { "object_name": "ExcludeLogicObject202_2", "uuid": "00000000-0000-0000-0000-000000000196", "is_exclude": 1, "items": [ { "table_type": "ip", "table_name": "IP_PLUS_CONFIG", "table_content": { "ip": "100.64.1.6-100.64.1.10" } } ] }, { "object_name": "ExcludeLogicObject202_3", "uuid": "00000000-0000-0000-0000-000000000197", "is_exclude": 1, "items": [ { "table_type": "ip", "table_name": "IP_PLUS_CONFIG", "table_content": { "ip": "100.64.1.11-100.64.1.20" } } ] }, { "object_name": "ExcludeLogicObject203_3_1", "uuid": "00000000-0000-0000-0000-000000000201", "is_exclude": 0, "items": [ { "table_type": "expr", "table_name": "KEYWORDS_TABLE", "table_content": { "expression": "jianshu.com$", "expr_type": "and" } } ] }, { "object_name": "ExcludeLogicObject203_3_2", "uuid": "00000000-0000-0000-0000-000000000202", "is_exclude": 1, "items": [ { "table_type": "expr", "table_name": "KEYWORDS_TABLE", "table_content": { "expression": "^www.jianshu.com$", "expr_type": "and" } } ] }, { "object_name": "ExcludeLogicObject204_3_1_1", "uuid": "00000000-0000-0000-0000-000000000207", "is_exclude": 0, "items": [ { "table_type": "expr", "table_name": "KEYWORDS_TABLE", "table_content": { "expression": "baidu.com$", "expr_type": "and" } } ] }, { "object_name": "ExcludeLogicObject204_3_1_2", "uuid": "00000000-0000-0000-0000-000000000208", "is_exclude": 1, "items": [ { "table_type": "expr", "table_name": "KEYWORDS_TABLE", "table_content": { "expression": "^www.baidu.com$", "expr_type": "and" } } ] }, { "object_name": "ExcludeLogicObject204_3_2", "uuid": "00000000-0000-0000-0000-000000000209", "is_exclude": 1, "items": [ { "table_type": "expr", "table_name": "KEYWORDS_TABLE", "table_content": { "expression": "^mail.baidu.com$", "expr_type": "and" } } ] }, { "object_name": "ExcludeLogicObject217_1_1", "uuid": "00000000-0000-0000-0000-000000000223", "is_exclude": 0, "items": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "expression": "string-of-rule-217.com$", "expr_type": "and" } } ] }, { "object_name": "ExcludeLogicObject217_1_2", "uuid": "00000000-0000-0000-0000-000000000224", "is_exclude": 1, "items": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "expression": "www.string-of-rule-217.com", "expr_type": "and" } } ] } ], "object_groups": [ { "object_uuid": "00000000-0000-0000-0000-000000000500", "included_sub_object_uuids": [ "00000000-0000-0000-0000-000000000106" ] }, { "object_uuid": "00000000-0000-0000-0000-000000000501", "included_sub_object_uuids": [ "00000000-0000-0000-0000-000000000141" ] }, { "object_uuid": "00000000-0000-0000-0000-000000000502", "included_sub_object_uuids": [ "00000000-0000-0000-0000-000000000100" ] }, { "object_uuid": "00000000-0000-0000-0000-000000000503", "included_sub_object_uuids": [ "00000000-0000-0000-0000-000000000189" ], "excluded_sub_object_uuids": [ "00000000-0000-0000-0000-000000000190" ] }, { "object_uuid": "00000000-0000-0000-0000-000000000504", "included_sub_object_uuids": [ "00000000-0000-0000-0000-000000000192" ], "excluded_sub_object_uuids": [ "00000000-0000-0000-0000-000000000193" ] }, { "object_uuid": "00000000-0000-0000-0000-000000000505", "included_sub_object_uuids": [ "00000000-0000-0000-0000-000000000195" ], "excluded_sub_object_uuids": [ "00000000-0000-0000-0000-000000000196", "00000000-0000-0000-0000-000000000197" ] }, { "object_uuid": "00000000-0000-0000-0000-000000000506", "included_sub_object_uuids": [ "00000000-0000-0000-0000-000000000201" ], "excluded_sub_object_uuids": [ "00000000-0000-0000-0000-000000000202" ] }, { "object_uuid": "00000000-0000-0000-0000-000000000507", "object_name": "ExcludeLogicObject204_3_1", "included_sub_object_uuids": [ "00000000-0000-0000-0000-000000000207" ], "excluded_sub_object_uuids": [ "00000000-0000-0000-0000-000000000208" ] }, { "object_uuid": "00000000-0000-0000-0000-000000000508", "object_name": "ExcludeLogicObject204_3", "included_sub_object_uuids": [ "00000000-0000-0000-0000-000000000507" ], "excluded_sub_object_uuids": [ "00000000-0000-0000-0000-000000000209" ] }, { "object_uuid": "00000000-0000-0000-0000-000000000509", "included_sub_object_uuids": [ "00000000-0000-0000-0000-000000000223" ], "excluded_sub_object_uuids": [ "00000000-0000-0000-0000-000000000224" ] } ], "rules": [ { "uuid": "00000000-0000-0000-0000-000000000123", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "escaped\\bdata:have\\ba\\bspace\\band\\ba\\b\\&\\bsymbol.", "is_valid": "yes", "and_conditions": [ { "attribute_name": "IP_CONFIG", "object_uuids": [ "00000000-0000-0000-0000-000000000100" ] }, { "attribute_name": "HTTP_URL", "objects": [ { "object_name": "123_url_object", "uuid": "00000000-0000-0000-0000-000000000101", "items": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "expression": "abckkk&123", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000124", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "anything", "is_valid": "yes", "and_conditions": [ { "attribute_name": "IP_CONFIG", "object_uuids": [ "00000000-0000-0000-0000-000000000100" ] }, { "attribute_name": "CONTENT_SIZE", "objects": [ { "object_name": "124_interval_object", "uuid": "00000000-0000-0000-0000-000000000102", "items": [ { "table_name": "CONTENT_SIZE", "table_type": "interval", "table_content": { "interval": "100-500" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000125", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "anything", "is_valid": "yes", "and_conditions": [ { "attribute_name": "HTTP_URL", "objects": [ { "object_name": "125_url_object", "uuid": "00000000-0000-0000-0000-000000000103", "items": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "expression": "action=search\\&query=(.*)", "expr_type": "regex" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000126", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "anything", "is_valid": "yes", "and_conditions": [ { "attribute_name": "HTTP_URL", "objects": [ { "object_name": "126_url_object", "uuid": "00000000-0000-0000-0000-000000000105", "items": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "expression": "should_not_hit_any_rule", "expr_type": "and" } } ] } ] }, { "attribute_name": "CONTENT_SIZE", "object_uuids": [ "00000000-0000-0000-0000-000000000106" ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000128", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "StringScan.ExprPlus", "is_valid": "yes", "and_conditions": [ { "attribute_name": "HTTP_SIGNATURE", "objects": [ { "object_name": "128_expr_object", "uuid": "00000000-0000-0000-0000-000000000107", "items": [ { "table_name": "HTTP_SIGNATURE", "table_type": "expr", "table_content": { "expression": "abckkk&123", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000129", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "utf8_中文", "is_valid": "yes", "and_conditions": [ { "attribute_name": "HTTP_URL", "objects": [ { "object_name": "129_url_object", "uuid": "00000000-0000-0000-0000-000000000108", "items": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "expression": "C#中国", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000130", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "utf8_维语", "is_valid": "yes", "and_conditions": [ { "attribute_name": "KEYWORDS_TABLE", "objects": [ { "object_name": "130_keywords_object", "uuid": "00000000-0000-0000-0000-000000000109", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "2010&يىلىدىكى", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000131", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "utf8_维语2", "is_valid": "yes", "and_conditions": [ { "attribute_name": "KEYWORDS_TABLE", "objects": [ { "object_name": "131_keywords_object", "uuid": "00000000-0000-0000-0000-000000000110", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "سىياسىي", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000132", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "string\\bunescape", "is_valid": "yes", "and_conditions": [ { "attribute_name": "KEYWORDS_TABLE", "object_name": "TakeMeHome", "object_uuid": "00000000-0000-0000-0000-000000000111" } ] }, { "uuid": "00000000-0000-0000-0000-000000000133", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "13018_table_conjunction_test_part1\bnow_its_very_very_long0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz", "is_valid": "yes", "and_conditions": [ { "attribute_name": "HTTP_URL", "objects": [ { "object_name": "133_host_object", "uuid": "00000000-0000-0000-0000-000000000112", "items": [ { "table_name": "HTTP_HOST", "table_type": "expr", "table_content": { "expression": "www.3300av.com", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000134", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "table_conjunction_test_part2", "is_valid": "yes", "and_conditions": [ { "attribute_name": "HTTP_URL", "objects": [ { "object_name": "134_url_object", "uuid": "00000000-0000-0000-0000-000000000113", "items": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "expression": "novel&27122.txt", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000136", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "effective_range":{}, "action_parameter": "offset_string", "is_valid": "yes", "and_conditions": [ { "attribute_name": "IMAGE_FP", "objects": [ { "object_name": "136_expr_object", "uuid": "00000000-0000-0000-0000-000000000114", "items": [ { "table_name": "IMAGE_FP", "table_type": "expr", "table_content": { "expression": "(offset=4362,depth=4458)|323031333A30333A30372032333A35363A313000323031333A30333A30372032333A35363A3130000000FFE20C584943435F50524F46494C4500010100000C484C696E6F021000006D6E74725247422058595A2007CE00020009000600310000|", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000137", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "effective_range":{}, "action_parameter": "offset_string", "is_valid": "yes", "and_conditions": [ { "attribute_name": "IMAGE_FP", "objects": [ { "object_name": "137_expr_object", "uuid": "00000000-0000-0000-0000-000000000115", "items": [ { "table_name": "IMAGE_FP", "table_type": "expr", "table_content": { "expression": "(offset=19339,depth=19467)|6CB2CB2F2028474C994991CCFC65CCA5E3B6FF001673985D157358610CACC674EE64CC27B5721CCDABD9CCA7C8E9F7BB1F54A930A6034D50F92711F5B2DACCB0715D2E6873CE5CE431DC701A194C260E9DB78CC89F2C84745869AB88349A3AE0412AB59D9ABA84EDEFFF0057FA4DA66D333698B5AD6F844DA2226D1CADAD5E44|", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000138", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "effective_range": {"tag_sets":[[{"tag":"location","value":["北京/朝阳/华严北里","上海/浦东/陆家嘴"]},{"tag":"isp","value":["电信","联通"]}],[{"tag":"location","value":["北京"]},{"tag":"isp","value":["联通"]}]]}, "action_parameter": "Not\\baccepted\\btags", "is_valid": "yes", "and_conditions": [ { "attribute_name": "HTTP_URL", "objects": [ { "object_name": "138_url_object", "uuid": "00000000-0000-0000-0000-000000000116", "items": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "expression": "should&hit&aaa", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000139", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "effective_range": "{\"tag_sets\":[[{\"tag\":\"location\",\"value\":[\"北京/朝阳/华严北里\"]},{\"tag\":\"isp\",\"value\":[\"电信\",\"移动\"]}]]}", "action_parameter": "Accepted\\btags", "is_valid": "yes", "and_conditions": [ { "attribute_name": "HTTP_URL", "objects": [ { "object_name": "139_url_object", "uuid": "00000000-0000-0000-0000-000000000117", "items": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "expression": "should&hit&bbb", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000140", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "file_streams", "is_valid": "yes", "and_conditions": [ { "attribute_name": "KEYWORDS_TABLE", "objects": [ { "object_name": "140_keywords_object", "uuid": "00000000-0000-0000-0000-000000000118", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "2018-10-05", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000141", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "Something:I\\bhave\\ba\\bname,7799", "rule_table_name": "RULE_ALIAS", "is_valid": "yes", "and_conditions": [ { "o2r_table_name": "OBJECT2RULE_ALIAS", "attribute_name": "HTTP_URL", "objects": [ { "object_name": "141_url_object", "uuid": "00000000-0000-0000-0000-000000000119", "items": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "expression": "i.ytimg.com", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000142", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "StringScan.UTF8EncodedURL", "is_valid": "yes", "and_conditions": [ { "attribute_name": "HTTP_URL", "objects": [ { "object_name": "142_url_object", "uuid": "00000000-0000-0000-0000-000000000120", "items": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "expression": ",IgpwcjA0LnN2bzAzKgkxMjcuMC4wLjE", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000143", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "NOTLogic.OneRegion", "is_valid": "yes", "and_conditions": [ { "attribute_name": "HTTP_URL_FILTER", "negate_option": false, "objects": [ { "object_name": "143_url_object1", "uuid": "00000000-0000-0000-0000-000000000121", "items": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "expression": "must-contained-string-of-rule-143", "expr_type": "and" } } ] } ] }, { "attribute_name": "HTTP_URL_FILTER", "negate_option": true, "objects": [ { "object_name": "143_url_object2", "uuid": "00000000-0000-0000-0000-000000000122", "items": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "expression": "must-not-contained-string-of-rule-143", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000144", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "NOTLogic.ScanNotAtLast", "is_valid": "yes", "and_conditions": [ { "attribute_name": "HTTP_URL_FILTER", "negate_option": false, "objects": [ { "object_name": "144_url_object", "uuid": "00000000-0000-0000-0000-000000000123", "items": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "expression": "must-contained-string-of-rule-144", "expr_type": "and" } } ] } ] }, { "attribute_name": "HTTP_RESPONSE_KEYWORDS", "negate_option": true, "objects": [ { "object_name": "144_keywords_object", "uuid": "00000000-0000-0000-0000-000000000124", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "must-not-contained-string-of-rule-144", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000145", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "NOTLogic.ScanNotIP", "is_valid": "yes", "and_conditions": [ { "attribute_name": "HTTP_URL", "negate_option": false, "objects": [ { "object_name": "145_url_object", "uuid": "00000000-0000-0000-0000-000000000125", "items": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "expression": "must-contained-string-of-rule-145", "expr_type": "and" } } ] } ] }, { "attribute_name": "ATTRIBUTE_IP_CONFIG", "negate_option": true, "object_uuids": [ "00000000-0000-0000-0000-000000000100" ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000146", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "NOTLogic.NotExprConditionAndNotIPCondition", "is_valid": "yes", "and_conditions": [ { "attribute_name": "HTTP_URL_FILTER", "negate_option": false, "condition_index": 0, "objects": [ { "object_name": "146_url_object", "uuid": "00000000-0000-0000-0000-000000000126", "items": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "expression": "must-contained-string-of-rule-146", "expr_type": "and" } } ] } ] }, { "attribute_name": "HTTP_RESPONSE_KEYWORDS", "negate_option": true, "condition_index": 1, "objects": [ { "object_name": "146_keywords_object", "uuid": "00000000-0000-0000-0000-000000000127", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "must-contained-not-string-of-rule-146", "expr_type": "and" } } ] } ] }, { "attribute_name": "ATTRIBUTE_IP_CONFIG", "negate_option": true, "condition_index": 2, "object_uuids": [ "00000000-0000-0000-0000-000000000100" ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000147", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "NOTLogic.8NotCondition", "is_valid": "yes", "and_conditions": [ { "attribute_name": "HTTP_RESPONSE_KEYWORDS_1", "negate_option": true, "condition_index": 0, "objects": [ { "object_name": "147_keywords_object1", "uuid": "00000000-0000-0000-0000-000000000128", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "condition0-in-rule-147", "expr_type": "and" } } ] } ] }, { "attribute_name": "HTTP_RESPONSE_KEYWORDS_2", "negate_option": true, "condition_index": 1, "objects": [ { "object_name": "147_keywords_object2", "uuid": "00000000-0000-0000-0000-000000000129", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "condition1-in-rule-147", "expr_type": "and" } } ] } ] }, { "attribute_name": "HTTP_RESPONSE_KEYWORDS_3", "negate_option": true, "condition_index": 2, "objects": [ { "object_name": "147_keywords_object3", "uuid": "00000000-0000-0000-0000-000000000130", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "condition2-in-rule-147", "expr_type": "and" } } ] } ] }, { "attribute_name": "HTTP_RESPONSE_KEYWORDS_4", "negate_option": true, "condition_index": 3, "objects": [ { "object_name": "147_keywords_object4", "uuid": "00000000-0000-0000-0000-000000000131", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "condition3-in-rule-147", "expr_type": "and" } } ] } ] }, { "attribute_name": "HTTP_RESPONSE_KEYWORDS_5", "negate_option": true, "condition_index": 4, "objects": [ { "object_name": "147_keywords_object5", "uuid": "00000000-0000-0000-0000-000000000132", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "condition4-in-rule-147", "expr_type": "and" } } ] } ] }, { "attribute_name": "HTTP_RESPONSE_KEYWORDS_6", "negate_option": true, "condition_index": 5, "objects": [ { "object_name": "147_keywords_object6", "uuid": "00000000-0000-0000-0000-000000000133", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "condition5-in-rule-147", "expr_type": "and" } } ] } ] }, { "attribute_name": "HTTP_RESPONSE_KEYWORDS_7", "negate_option": true, "condition_index": 6, "objects": [ { "object_name": "147_keywords_object7", "uuid": "00000000-0000-0000-0000-000000000134", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "condition6-in-rule-147", "expr_type": "and" } } ] } ] }, { "attribute_name": "HTTP_RESPONSE_KEYWORDS_8", "negate_option": true, "condition_index": 7, "objects": [ { "object_name": "147_keywords_object8", "uuid": "00000000-0000-0000-0000-000000000135", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "condition7-in-rule-147", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000148", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "StringScan.Regex", "is_valid": "yes", "and_conditions": [ { "attribute_name": "HTTP_URL", "objects": [ { "object_name": "148_url_object", "uuid": "00000000-0000-0000-0000-000000000136", "items": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "expression": "Cookie:\\s.*head", "expr_type": "regex" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000150", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "StringScan.BugReport20190325", "is_valid": "yes", "and_conditions": [ { "attribute_name": "TROJAN_PAYLOAD", "objects": [ { "object_name": "billgates_regist1", "uuid": "00000000-0000-0000-0000-000000000138", "items": [ { "table_type": "expr", "table_name": "TROJAN_PAYLOAD", "table_content": { "expression": "(offset=0,depth=4)|01000000|", "expr_type": "and" } } ] } ] }, { "attribute_name": "TROJAN_PAYLOAD", "objects": [ { "object_name": "billgates_regist2", "uuid": "00000000-0000-0000-0000-000000000139", "items": [ { "table_type": "expr", "table_name": "TROJAN_PAYLOAD", "table_content": { "expression": "1:G2.40", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000151", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "StringScan.PrefixAndSuffix", "is_valid": "yes", "and_conditions": [ { "attribute_name": "MAIL_ADDR", "objects": [ { "object_name": "151_expr_object", "uuid": "00000000-0000-0000-0000-000000000140", "items": [ { "table_type": "expr", "table_name": "MAIL_ADDR", "table_content": { "expression": "ceshi3@mailhost.cn$", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000152", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "StringScan.PrefixAndSuffix", "is_valid": "yes", "and_conditions": [ { "attribute_name": "MAIL_ADDR", "object_uuids": [ "00000000-0000-0000-0000-000000000141" ] }, { "attribute_name": "CONTENT_SIZE", "object_uuids": [ "00000000-0000-0000-0000-000000000500" ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000153", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "Policy.SubObject", "is_valid": "yes", "and_conditions": [ { "attribute_name": "MAIL_ADDR", "negate_option": false, "object_uuids": [ "00000000-0000-0000-0000-000000000143", "00000000-0000-0000-0000-000000000501" ] }, { "attribute_name": "IP_CONFIG", "object_uuids": [ "00000000-0000-0000-0000-000000000502" ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000154", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "ipv4_plus", "is_valid": "yes", "and_conditions": [ { "attribute_name": "IP_PLUS_CONFIG", "negate_option": false, "objects": [ { "object_name": "154_IP_object", "uuid": "00000000-0000-0000-0000-000000000145", "items": [ { "table_type": "ip", "table_name": "IP_PLUS_CONFIG", "table_content": { "ip": "10.0.7.100-10.0.7.101" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000155", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "ipv6_plus", "is_valid": "yes", "and_conditions": [ { "attribute_name": "IP_PLUS_CONFIG", "negate_option": false, "objects": [ { "object_name": "155_IP_object", "uuid": "00000000-0000-0000-0000-000000000146", "items": [ { "table_type": "ip", "table_name": "IP_PLUS_CONFIG", "table_content": { "ip": "1001:da8:205:1::101-1001:da8:205:1::102" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000157", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "StringScan.StreamScanUTF8", "is_valid": "yes", "and_conditions": [ { "attribute_name": "TROJAN_PAYLOAD", "objects": [ { "object_name": "157_expr_object", "uuid": "00000000-0000-0000-0000-000000000148", "items": [ { "table_type": "expr", "table_name": "TROJAN_PAYLOAD", "table_content": { "expression": "我的订单", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000158", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "IPScan.IPv4_CIDR", "is_valid": "yes", "and_conditions": [ { "attribute_name": "IP_PLUS_CONFIG", "objects": [ { "object_name": "158_IP_object", "uuid": "00000000-0000-0000-0000-000000000149", "items": [ { "table_type": "ip", "table_name": "IP_PLUS_CONFIG", "table_content": { "ip": "192.168.0.1/32" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000159", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "IPScan.IPv6_CIDR", "is_valid": "yes", "and_conditions": [ { "attribute_name": "IP_PLUS_CONFIG", "objects": [ { "object_name": "159_IP_object", "uuid": "00000000-0000-0000-0000-000000000150", "items": [ { "table_type": "ip", "table_name": "IP_PLUS_CONFIG", "table_content": { "ip": "2001:db8::/120" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000160", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "AttributeWithOnePhysical", "is_valid": "yes", "and_conditions": [ { "attribute_name": "HTTP_RESPONSE_KEYWORDS", "negate_option": false, "object_uuids":[ "00000000-0000-0000-0000-000000000111" ] }, { "attribute_name": "HTTP_URL", "negate_option": false, "objects": [ { "object_name": "160_url_object", "uuid": "00000000-0000-0000-0000-000000000151", "items": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "expression": "https://blog.csdn.net/littlefang/article/details/8213058", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000163", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "OneObjectInTwoAttribute", "is_valid": "yes", "and_conditions": [ { "attribute_name": "HTTP_REQUEST_HEADER", "negate_option": false, "objects": [ { "object_name": "vt_grp_http_sig2", "uuid": "00000000-0000-0000-0000-000000000153", "items": [ { "table_name": "HTTP_SIGNATURE", "table_type": "expr", "table_content": { "expression": "uid=12345678", "expr_type": "and" } }, { "table_name": "HTTP_SIGNATURE", "table_type": "expr", "table_content": { "expression": "sessionid=888888", "expr_type": "and" } } ] } ] }, { "attribute_name": "HTTP_RESPONSE_HEADER", "negate_option": false, "object_name": "vt_grp_http_sig2" } ] }, { "uuid": "00000000-0000-0000-0000-000000000164", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "CharsetWindows1251", "is_valid": "yes", "and_conditions": [ { "attribute_name": "KEYWORDS_TABLE", "objects": [ { "object_name": "164_keywords_object", "uuid": "00000000-0000-0000-0000-000000000154", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": ">ЗАО «Севергазвтоматика АйС»<", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000165", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "EvaluationOrder", "is_valid": "yes", "evaluation_order": "2.111", "and_conditions": [ { "attribute_name": "HTTP_URL", "objects": [ { "object_name": "165_url_object", "uuid": "00000000-0000-0000-0000-000000000155", "items": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "expression": "cavemancircus.com/", "expr_type": "and" } } ] } ] }, { "attribute_name": "IP_PLUS_CONFIG", "negate_option": false, "objects": [ { "object_name": "165_IP_object", "uuid": "00000000-0000-0000-0000-000000000156", "items": [ { "table_type": "ip", "table_name": "IP_PLUS_CONFIG", "table_content": { "ip": "192.168.23.1/24" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000166", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "EvaluationOrder", "is_valid": "yes", "evaluation_order": "100.233", "and_conditions": [ { "attribute_name": "HTTP_URL", "objects": [ { "object_name": "166_url_object", "uuid": "00000000-0000-0000-0000-000000000157", "items": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "expression": "2019/12/27/pretty-girls-6", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000167", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "EvaluationOrder", "is_valid": "yes", "evaluation_order": "300.999", "and_conditions": [ { "attribute_name": "HTTP_URL", "condition_index": 1, "object_uuids": [ "00000000-0000-0000-0000-000000000158" ] }, { "attribute_name": "HTTP_URL", "object_uuids": [ "00000000-0000-0000-0000-000000000158" ], "condition_index": 3 } ] }, { "uuid": "00000000-0000-0000-0000-000000000168", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "EvaluationOrder", "is_valid": "yes", "evaluation_order": "0", "and_conditions": [ { "attribute_name": "HTTP_URL", "object_uuids": [ "00000000-0000-0000-0000-000000000158" ], "condition_index": 2 }, { "attribute_name": "HTTP_URL", "object_uuids": [ "00000000-0000-0000-0000-000000000158" ], "condition_index": 6 } ] }, { "uuid": "00000000-0000-0000-0000-000000000169", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "IPScan.IPv4_Any", "is_valid": "yes", "and_conditions": [ { "attribute_name": "IP_PLUS_CONFIG", "condition_index": 0, "negate_option": false, "objects": [ { "object_name": "169_IP_object", "uuid": "00000000-0000-0000-0000-000000000160", "items": [ { "table_type": "ip", "table_name": "IP_PLUS_CONFIG", "table_content": { "ip": "100.64.3.1/32" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000170", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "IPScan.IPv4_attribute_name.source", "is_valid": "no", "and_conditions": [ { "attribute_name": "IP_PLUS_CONFIG", "negate_option": false, "objects": [ { "object_name": "ipv4_attribute_name.source", "uuid": "00000000-0000-0000-0000-000000000161", "items": [ { "table_type": "ip", "table_name": "IP_PLUS_CONFIG", "table_content": { "ip": "192.168.40.10/32" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000171", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "IPScan.IPv4_attribute_name.destination", "is_valid": "no", "and_conditions": [ { "attribute_name": "IP_PLUS_CONFIG", "negate_option": false, "objects": [ { "object_name": "ipv4_attribute_name.destination", "uuid": "00000000-0000-0000-0000-000000000162", "items": [ { "table_type": "ip", "table_name": "IP_PLUS_CONFIG", "table_content": { "ip": "192.168.231.46/32" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000177", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "NOTLogic.Multiand_conditionsInOneNotCondition", "is_valid": "yes", "and_conditions": [ { "attribute_name": "ASN_NOT_LOGIC", "negate_option": true, "object_uuids": [ "00000000-0000-0000-0000-000000000001", "00000000-0000-0000-0000-000000000003", "00000000-0000-0000-0000-000000000004" ], "condition_index": 0 }, { "attribute_name": "DESTINATION_IP_ASN", "negate_option": false, "object_uuids": [ "00000000-0000-0000-0000-000000000002" ], "condition_index": 1 } ] }, { "uuid": "00000000-0000-0000-0000-000000000178", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "Hierarchy.MultiObjectInOneCondition", "is_valid": "yes", "and_conditions": [ { "attribute_name": "SOURCE_IP_ASN", "object_uuids": [ "00000000-0000-0000-0000-000000000001", "00000000-0000-0000-0000-000000000003", "00000000-0000-0000-0000-000000000004" ], "negate_option": false, "condition_index": 0 }, { "attribute_name": "DESTINATION_IP_ASN", "negate_option": false, "object_uuids": [ "00000000-0000-0000-0000-000000000002" ], "condition_index": 1 } ] }, { "uuid": "00000000-0000-0000-0000-000000000180", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "Hierarchy.MultiObjectInOneCondition", "is_valid": "yes", "and_conditions": [ { "negate_option": false, "or_conditions":[ { "attribute_name": "SOURCE_IP_ASN", "object_uuids": [ "00000000-0000-0000-0000-000000000001", "00000000-0000-0000-0000-000000000003", "00000000-0000-0000-0000-000000000004" ] }, { "attribute_name": "SOURCE_IP_GEO", "object_uuids": [ "00000000-0000-0000-0000-000000000015" ] } ] }, { "attribute_name": "IP_CONFIG", "negate_option": false, "object_uuids": [ "00000000-0000-0000-0000-000000000012" ], "condition_index": 1 } ] }, { "uuid": "00000000-0000-0000-0000-000000000181", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "NOTLogic.MultiLiteralsInOneNotCondition", "is_valid": "yes", "and_conditions": [ { "negate_option": true, "or_conditions": [ { "attribute_name": "SOURCE_IP_ASN", "object_uuids": [ "00000000-0000-0000-0000-000000000001", "00000000-0000-0000-0000-000000000003", "00000000-0000-0000-0000-000000000004" ] }, { "attribute_name": "IP_PLUS_CONFIG", "object_uuids": [ "00000000-0000-0000-0000-000000000014" ] } ] }, { "attribute_name": "SOURCE_IP_GEO", "negate_option": false, "object_uuids": [ "00000000-0000-0000-0000-000000000015" ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000182", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "8-expr", "is_valid": "yes", "and_conditions": [ { "attribute_name": "KEYWORDS_TABLE", "objects": [ { "object_name": "182_keywords_object", "uuid": "00000000-0000-0000-0000-000000000167", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "string1&string2&string3&string4&string5&string6&string7&string8", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000184", "action_parameter": "APP_ID=6006740;Liumengyan-Bugreport-20210515", "description": "Hulu", "is_valid": "yes", "do_blacklist": 0, "do_log": 0, "action": 0, "service": 0, "and_conditions": [ { "attribute_name": "IP_CONFIG", "objects": [ { "object_name": "184_IP_object", "uuid": "00000000-0000-0000-0000-000000000169", "items": [ { "table_name": "IP_CONFIG", "table_type": "ip", "table_content": { "ip": "::/128" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000185", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "NOTLogic.SameAttributeInMultiCondition", "is_valid": "yes", "and_conditions": [ { "negate_option": true, "or_conditions": [ { "attribute_name": "DESTINATION_IP_ASN", "object_uuids": [ "00000000-0000-0000-0000-000000000001", "00000000-0000-0000-0000-000000000003", "00000000-0000-0000-0000-000000000004" ] }, { "attribute_name": "SOURCE_IP_GEO", "object_uuids": [ "00000000-0000-0000-0000-000000000015" ] } ] }, { "attribute_name": "DESTINATION_IP_ASN", "negate_option": true, "object_uuids": [ "00000000-0000-0000-0000-000000000005" ], "condition_index": 1 }, { "attribute_name": "DESTINATION_IP_ASN", "negate_option": false, "object_uuids": [ "00000000-0000-0000-0000-000000000006" ], "condition_index": 2 }, { "attribute_name": "IP_PLUS_CONFIG", "negate_option": false, "object_uuids": [ "00000000-0000-0000-0000-000000000013" ], "condition_index": 3 } ] }, { "uuid": "00000000-0000-0000-0000-000000000186", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "NOTLogic.ScanHitAtLast", "is_valid": "yes", "and_conditions": [ { "attribute_name": "HTTP_URL_FILTER", "negate_option": true, "objects": [ { "object_name": "186_expr_object", "uuid": "00000000-0000-0000-0000-000000000170", "items": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "expression": "must-not-contained-string-of-rule-186", "expr_type": "and" } } ] } ] }, { "attribute_name": "IP_PLUS_CONFIG", "negate_option": false, "objects": [ { "object_name": "186_IP_object", "uuid": "00000000-0000-0000-0000-000000000171", "items": [ { "table_type": "ip", "table_name": "IP_PLUS_CONFIG", "table_content": { "ip": "10.0.8.186" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000187", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "NOTLogic.ScanHitAtLast", "is_valid": "yes", "and_conditions": [ { "attribute_name": "HTTP_URL_FILTER", "negate_option": true, "objects": [ { "object_name": "187_url_object", "uuid": "00000000-0000-0000-0000-000000000172", "items": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "expression": "must-not-contained-string-of-rule-187", "expr_type": "and" } } ] } ] }, { "attribute_name": "IP_PLUS_CONFIG", "negate_option": false, "objects": [ { "object_name": "187_IP_object", "uuid": "00000000-0000-0000-0000-000000000173", "items": [ { "table_type": "ip", "table_name": "IP_PLUS_CONFIG", "table_content": { "ip": "10.0.8.187" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000188", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "NOTLogic.ScanHitAtLast", "is_valid": "yes", "and_conditions": [ { "attribute_name": "HTTP_URL_FILTER", "negate_option": true, "objects": [ { "object_name": "188_url_object", "uuid": "00000000-0000-0000-0000-000000000174", "items": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "expression": "must-not-contained-string-of-rule-188", "expr_type": "and" } } ] } ] }, { "attribute_name": "IP_PLUS_CONFIG", "negate_option": false, "objects": [ { "object_name": "188_IP_object", "uuid": "00000000-0000-0000-0000-000000000175", "items": [ { "table_type": "ip", "table_name": "IP_PLUS_CONFIG", "table_content": { "ip": "10.0.8.188" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000189", "is_valid": "yes", "do_log": 0, "action": 0, "service": 0, "do_blacklist": 0, "action_parameter": "StringScan.ShouldNotHitExprPlus", "and_conditions": [ { "attribute_name": "APP_PAYLOAD", "objects": [ { "object_name": "189_app_object", "uuid": "00000000-0000-0000-0000-000000000176", "items": [ { "table_name": "APP_PAYLOAD", "table_type": "expr", "table_content": { "expression": "|ab00|", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000191", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "StringScan.HexBinCaseSensitive", "is_valid": "yes", "and_conditions": [ { "attribute_name": "KEYWORDS_TABLE", "objects": [ { "object_name": "191_keywords_object", "uuid": "00000000-0000-0000-0000-000000000178", "items": [ { "table_type": "expr", "table_name": "KEYWORDS_TABLE", "table_content": { "expression": "|54455354|", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000192", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "anything", "is_valid": "yes", "and_conditions": [ { "attribute_name": "FLAG_CONFIG", "objects": [ { "object_name": "192_flag_object", "uuid": "00000000-0000-0000-0000-000000000179", "items": [ { "table_type": "flag", "table_name": "FLAG_CONFIG", "table_content": { "flag": 1, "mask": 3 } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000193", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "anything", "is_valid": "yes", "and_conditions": [ { "attribute_name": "FLAG_CONFIG", "objects": [ { "object_name": "193_flag_object", "uuid": "00000000-0000-0000-0000-000000000180", "items": [ { "table_type": "flag", "table_name": "FLAG_CONFIG", "table_content": { "flag": 2, "mask": 3 } } ] } ] }, { "attribute_name": "HTTP_URL", "objects": [ { "object_name": "193_url_object", "uuid": "00000000-0000-0000-0000-000000000181", "items": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "expression": "hello", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000194", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "anything", "is_valid": "yes", "and_conditions": [ { "attribute_name": "FLAG_CONFIG", "objects": [ { "object_name": "194_flag_object", "uuid": "00000000-0000-0000-0000-000000000182", "items": [ { "table_type": "flag", "table_name": "FLAG_CONFIG", "table_content": { "flag": 21, "mask": 31 } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000197", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "Something:I\\bhave\\ba\\bname,8866", "is_valid": "yes", "and_conditions": [ { "attribute_name": "HTTP_URL", "objects": [ { "object_name": "197_url_object", "uuid": "00000000-0000-0000-0000-000000000186", "items": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "expression": "hqdefault.jpg", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000198", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "Something:I have a name,7799", "rule_table_name": "RULE_FIREWALL_DEFAULT", "is_valid": "yes", "and_conditions": [ { "o2r_table_name": "OBJECT2RULE_FIREWALL", "attribute_name": "HTTP_URL", "objects": [ { "object_name": "198_url_object", "uuid": "00000000-0000-0000-0000-000000000187", "items": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "expression": "firewall", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000199", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "ExcludeLogic.ScanNotAtLast", "is_valid": "yes", "and_conditions": [ { "attribute_name": "HTTP_URL", "object_name": "ExcludeLogicObject199", "object_uuids": [ "00000000-0000-0000-0000-000000000503" ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000200", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "ExcludeLogic.OneRegion", "is_valid": "yes", "and_conditions": [ { "attribute_name": "HTTP_URL", "object_uuids": [ "00000000-0000-0000-0000-000000000504" ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000202", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "null", "is_valid": "yes", "and_conditions": [ { "attribute_name": "ATTRIBUTE_IP_PLUS_TABLE", "object_name": "ExcludeLogicObject202", "object_uuids": [ "00000000-0000-0000-0000-000000000505" ], "condition_index": 0 } ] }, { "uuid": "00000000-0000-0000-0000-000000000203", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "null", "is_valid": "yes", "and_conditions": [ { "attribute_name": "ATTRIBUTE_IP_PLUS_SOURCE", "objects": [ { "object_name": "ExcludeLogicObject203_1", "uuid": "00000000-0000-0000-0000-000000000198", "items": [ { "table_name": "IP_PLUS_CONFIG", "table_type": "ip", "table_content": { "ip": "192.168.50.43-192.168.50.43" } } ] } ] }, { "attribute_name": "ATTRIBUTE_IP_PLUS_DESTINATION", "objects": [ { "object_name": "ExcludeLogicObject203_2", "uuid": "00000000-0000-0000-0000-000000000199", "items": [ { "table_name": "IP_PLUS_CONFIG", "table_type": "ip", "table_content": { "ip": "47.92.108.93-47.92.108.93" } } ] } ] }, { "attribute_name": "HTTP_RESPONSE_KEYWORDS", "object_name": "ExcludeLogicObject203_3", "object_uuids": [ "00000000-0000-0000-0000-000000000506" ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000204", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "null", "is_valid": "yes", "and_conditions": [ { "attribute_name": "ATTRIBUTE_IP_PLUS_SOURCE", "objects": [ { "object_name": "ExcludeLogicObject204_1", "uuid": "00000000-0000-0000-0000-000000000203", "items": [ { "table_name": "IP_PLUS_CONFIG", "table_type": "ip", "table_content": { "ip": "100.64.2.0-100.64.2.5" } } ] } ] }, { "attribute_name": "ATTRIBUTE_IP_PLUS_DESTINATION", "objects": [ { "object_name": "ExcludeLogicObject204_2", "uuid": "00000000-0000-0000-0000-000000000204", "items": [ { "table_name": "IP_PLUS_CONFIG", "table_type": "ip", "table_content": { "ip": "100.64.2.6-100.64.2.10" } } ] } ] }, { "attribute_name": "HTTP_RESPONSE_KEYWORDS", "object_uuids": [ "00000000-0000-0000-0000-000000000508" ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000205", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "StringScan.RegexExpressionIllegal", "is_valid": "yes", "and_conditions": [ { "attribute_name": "KEYWORDS_TABLE", "objects": [ { "object_name": "205_keywords_object", "uuid": "00000000-0000-0000-0000-000000000210", "items": [ { "table_type": "expr", "table_name": "KEYWORDS_TABLE", "table_content": { "expression": "123^456", "expr_type": "regex" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000206", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "duplicateRuleFor191", "is_valid": "yes", "and_conditions": [ { "attribute_name": "KEYWORDS_TABLE", "objects": [ { "object_name": "206_keywords_object", "uuid": "00000000-0000-0000-0000-000000000211", "items": [ { "table_type": "expr", "table_name": "KEYWORDS_TABLE", "table_content": { "expression": "|54455354|", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000207", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "duplicateRuleFor192", "is_valid": "yes", "and_conditions": [ { "attribute_name": "FLAG_CONFIG", "objects": [ { "object_name": "207_flag_object", "uuid": "00000000-0000-0000-0000-000000000212", "items": [ { "table_type": "flag", "table_name": "FLAG_CONFIG", "table_content": { "flag": 1, "mask": 3 } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000208", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "duplicateRuleFor154", "is_valid": "yes", "and_conditions": [ { "attribute_name": "IP_PLUS_CONFIG", "negate_option": false, "objects": [ { "object_name": "208_IP_object", "uuid": "00000000-0000-0000-0000-000000000213", "items": [ { "table_type": "ip", "table_name": "IP_PLUS_CONFIG", "table_content": { "ip": "10.0.7.100-10.0.7.106" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000210", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "ipv6_::", "is_valid": "yes", "and_conditions": [ { "attribute_name": "IP_PLUS_CONFIG", "objects": [ { "object_name": "210_IP_object", "uuid": "00000000-0000-0000-0000-000000000215", "items": [ { "table_type": "ip", "table_name": "IP_PLUS_CONFIG", "table_content": { "ip": "::/0" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000211", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "ip_perf_test", "is_valid": "yes", "and_conditions": [ { "attribute_name": "IP_PERF_CONFIG", "negate_option": false, "objects": [ { "object_name": "211_IP_object", "uuid": "00000000-0000-0000-0000-000000000216", "items": [ { "table_type": "ip", "table_name": "IP_PERF_CONFIG", "table_content": { "ip": "10.0.0.1-10.0.0.6" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000212", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "integer_perf_test", "is_valid": "yes", "and_conditions": [ { "attribute_name": "INTEGER_PERF_CONFIG", "objects": [ { "object_name": "212_interval_object", "uuid": "00000000-0000-0000-0000-000000000217", "items": [ { "table_name": "INTEGER_PERF_CONFIG", "table_type": "interval", "table_content": { "interval": "3000" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000213", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "expr_perf_test", "is_valid": "yes", "and_conditions": [ { "attribute_name": "EXPR_LITERAL_PERF_CONFIG", "objects": [ { "object_name": "213_expr_object", "uuid": "00000000-0000-0000-0000-000000000218", "items": [ { "table_name": "EXPR_LITERAL_PERF_CONFIG", "table_type": "expr", "table_content": { "expression": "today&yesterday", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000214", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "flag_perf_test", "is_valid": "yes", "and_conditions": [ { "attribute_name": "FLAG_PERF_CONFIG", "objects": [ { "object_name": "214_flag_object", "uuid": "00000000-0000-0000-0000-000000000219", "items": [ { "table_type": "flag", "table_name": "FLAG_PERF_CONFIG", "table_content": { "flag": 15, "mask": 15 } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000215", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "expr_perf_test", "is_valid": "yes", "and_conditions": [ { "attribute_name": "EXPR_REGEX_PERF_CONFIG", "objects": [ { "object_name": "215_expr_object", "uuid": "00000000-0000-0000-0000-000000000220", "items": [ { "table_name": "EXPR_REGEX_PERF_CONFIG", "table_type": "expr", "table_content": { "expression": "action=search\\&query=(.*)", "expr_type": "regex" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000216", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "NOTCondition&ExcludeObject", "is_valid": "yes", "and_conditions": [ { "attribute_name": "HTTP_URL_FILTER", "negate_option": false, "object_uuids": [ "00000000-0000-0000-0000-000000000504" ], "condition_index": 0 }, { "attribute_name": "HTTP_RESPONSE_KEYWORDS", "negate_option": true, "condition_index": 1, "objects": [ { "object_name": "NOTConditionAndExcludeObject216", "uuid": "00000000-0000-0000-0000-000000000221", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "keywords-for-rule-211", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000217", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "NOTCondition&ExcludeObject", "is_valid": "yes", "and_conditions": [ { "attribute_name": "HTTP_URL_FILTER", "negate_option": true, "object_uuids": [ "00000000-0000-0000-0000-000000000509" ], "condition_index": 0 }, { "attribute_name": "HTTP_RESPONSE_KEYWORDS", "negate_option": false, "condition_index": 1, "objects": [ { "object_name": "NOTConditionAndExcludeObject217_2", "uuid": "00000000-0000-0000-0000-000000000225", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "keywords-for-rule-217", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000218", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "anything", "is_valid": "yes", "and_conditions": [ { "attribute_name": "CONTENT_SIZE", "objects": [ { "object_name": "218_interval_object", "uuid": "00000000-0000-0000-0000-000000000226", "items": [ { "table_name": "CONTENT_SIZE", "table_type": "interval", "table_content": { "interval": "3000" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000219", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "anything", "is_valid": "yes", "and_conditions": [ { "attribute_name": "HTTP_DUMMY", "negate_option": false, "condition_index": 0, "objects": [ { "object_name": "NOTConditionAndExcludeObject219_1", "uuid": "00000000-0000-0000-0000-000000000227", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "keywords-dummy-219-1", "expr_type": "and" } } ] } ] }, { "attribute_name": "HTTP_DUMMY", "negate_option": true, "condition_index": 1, "objects": [ { "object_name": "NOTConditionAndExcludeObject219_2", "uuid": "00000000-0000-0000-0000-000000000228", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "keywords-dummy-219-2", "expr_type": "and" } } ] } ] }, { "attribute_name": "HTTP_DUMMY", "negate_option": true, "condition_index": 2, "objects": [ { "object_name": "NOTConditionAndExcludeObject219_3", "uuid": "00000000-0000-0000-0000-000000000229", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "keywords-dummy-219-3", "expr_type": "and" } } ] } ] }, { "attribute_name": "HTTP_DUMMY", "negate_option": true, "condition_index": 3, "objects": [ { "object_name": "NOTConditionAndExcludeObject219_4", "uuid": "00000000-0000-0000-0000-000000000230", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "keywords-dummy-219-4", "expr_type": "and" } } ] } ] }, { "attribute_name": "HTTP_DUMMY", "negate_option": true, "condition_index": 4, "objects": [ { "object_name": "NOTConditionAndExcludeObject219_5", "uuid": "00000000-0000-0000-0000-000000000231", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "keywords-dummy-219-5", "expr_type": "and" } } ] } ] }, { "attribute_name": "HTTP_DUMMY", "negate_option": true, "condition_index": 5, "objects": [ { "object_name": "NOTConditionAndExcludeObject219_6", "uuid": "00000000-0000-0000-0000-000000000232", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "keywords-dummy-219-6", "expr_type": "and" } } ] } ] }, { "attribute_name": "HTTP_DUMMY", "negate_option": true, "condition_index": 6, "objects": [ { "object_name": "NOTConditionAndExcludeObject219_7", "uuid": "00000000-0000-0000-0000-000000000233", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "keywords-dummy-219-7", "expr_type": "and" } } ] } ] }, { "attribute_name": "HTTP_DUMMY", "negate_option": true, "condition_index": 7, "objects": [ { "object_name": "NOTConditionAndExcludeObject219_8", "uuid": "00000000-0000-0000-0000-000000000234", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "keywords-dummy-219-8", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000220", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "anything", "is_valid": "yes", "and_conditions": [ { "attribute_name": "HTTP_DUMMY", "negate_option": false, "condition_index": 0, "objects": [ { "object_name": "NOTConditionAndExcludeObject220_1", "uuid": "00000000-0000-0000-0000-000000000235", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "keywords-dummy-220-1", "expr_type": "and" } } ] } ] }, { "attribute_name": "HTTP_DUMMY", "negate_option": true, "condition_index": 1, "objects": [ { "object_name": "NOTConditionAndExcludeObject220_2", "uuid": "00000000-0000-0000-0000-000000000236", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "keywords-dummy-220-2", "expr_type": "and" } } ] } ] }, { "attribute_name": "HTTP_DUMMY", "negate_option": true, "condition_index": 2, "objects": [ { "object_name": "NOTConditionAndExcludeObject220_3", "uuid": "00000000-0000-0000-0000-000000000237", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "keywords-dummy-220-3", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000222", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "NOTLogic.SingleNotCondition", "is_valid": "yes", "and_conditions": [ { "attribute_name": "HTTP_NOT_LOGIC_1", "negate_option": true, "condition_index": 0, "objects": [ { "object_name": "NOTLogicObject_222", "uuid": "00000000-0000-0000-0000-000000000240", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "not_logic_keywords_222", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000223", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "NOTLogic.MultiNotCondition", "is_valid": "yes", "and_conditions": [ { "attribute_name": "HTTP_NOT_LOGIC", "negate_option": true, "condition_index": 0, "objects": [ { "object_name": "NOTLogicObject_223_1", "uuid": "00000000-0000-0000-0000-000000000241", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "not_logic_rule_223_1", "expr_type": "and" } } ] } ] }, { "attribute_name": "HTTP_NOT_LOGIC", "negate_option": true, "condition_index": 1, "objects": [ { "object_name": "NOTLogicObject_223_2", "uuid": "00000000-0000-0000-0000-000000000242", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "not_logic_rule_223_2", "expr_type": "and" } } ] } ] }, { "attribute_name": "HTTP_NOT_LOGIC", "negate_option": true, "condition_index": 2, "objects": [ { "object_name": "NOTLogicObject_223_1", "uuid": "00000000-0000-0000-0000-000000000243", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "not_logic_rule_223_3", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000224", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "NOTLogic.NotPhysicalTable", "is_valid": "yes", "and_conditions": [ { "attribute_name": "KEYWORDS_TABLE", "negate_option": true, "condition_index": 0, "objects": [ { "object_name": "NOTLogicObject_224_1", "uuid": "00000000-0000-0000-0000-000000000244", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "not_logic_rule_224_1", "expr_type": "and" } } ] } ] }, { "attribute_name": "HTTP_RESPONSE_KEYWORDS", "negate_option": false, "condition_index": 1, "objects": [ { "object_name": "NOTLogicObject_224_2", "uuid": "00000000-0000-0000-0000-000000000245", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "not_logic_rule_224_2", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000225", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "Payload escape", "is_valid": "yes", "and_conditions": [ { "attribute_name": "KEYWORDS_TABLE", "negate_option": false, "condition_index": 0, "objects": [ { "object_name": "EscapeObject_225_1", "uuid": "00000000-0000-0000-0000-000000000246", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "GET / HTTP/1.1\\r\\nHost: www.baidu.com\\r\\n\\r\\n", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000226", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "maat_scan_object", "is_valid": "yes", "and_conditions": [ { "attribute_name": "KEYWORDS_TABLE", "object_name": "226_url_object", "object_uuids": [ "00000000-0000-0000-0000-000000000247" ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000227", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "maat_scan_object", "rule_table_name": "RULE_FIREWALL_DEFAULT", "is_valid": "yes", "and_conditions": [ { "attribute_name": "KEYWORDS_TABLE", "object_name": "227_url_object", "object_uuids": [ "00000000-0000-0000-0000-000000000248" ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000228", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "NotConditionHitPath", "is_valid": "yes", "and_conditions": [ { "attribute_name": "HTTP_URL", "negate_option": false, "condition_index": 1, "objects": [ { "object_name": "228_url_object", "uuid": "00000000-0000-0000-0000-000000000249", "items": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "expression": "youtube.com", "expr_type": "and" } } ] } ] }, { "attribute_name": "ATTRIBUTE_IP_CONFIG", "negate_option": true, "condition_index": 2, "objects": [ { "object_name": "228_IP_object", "uuid": "00000000-0000-0000-0000-000000000250", "items": [ { "table_name": "IP_CONFIG", "table_type": "ip", "table_content": { "ip": "192.168.101.102/32" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000229", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "StringScan.Regex", "is_valid": "yes", "and_conditions": [ { "attribute_name": "HTTP_URL", "objects": [ { "object_name": "229_url_object", "uuid": "00000000-0000-0000-0000-000000000251", "items": [ { "table_name": "HTTP_URL", "table_type": "expr", "table_content": { "expression": "É", "expr_type": "regex" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000230", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "ipv6_::", "is_valid": "yes", "and_conditions": [ { "attribute_name": "IP_PLUS_CONFIG", "objects": [ { "object_name": "230_IP_object", "uuid": "00000000-0000-0000-0000-000000000256", "items": [ { "table_type": "ip", "table_name": "IP_PLUS_CONFIG", "table_content": { "ip": "2607:5d00:2:2::32:28/128", "port": "80-443" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000231", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "should_not_hit", "is_valid": "yes", "and_conditions": [ { "attribute_name": "IP_PLUS_CONFIG", "objects": [ { "object_name": "231_IP_object", "uuid": "00000000-0000-0000-0000-000000000257", "items": [ { "table_type": "ip", "table_name": "IP_PLUS_CONFIG", "table_content": { "ip": "2607:5d00:2:2::32:28/128", "port": "80" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000232", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "should_not_hit", "is_valid": "yes", "and_conditions": [ { "attribute_name": "IP_PLUS_CONFIG", "objects": [ { "object_name": "232_IP_object", "uuid": "00000000-0000-0000-0000-000000000258", "items": [ { "table_type": "ip", "table_name": "IP_PLUS_CONFIG", "table_content": { "ip": "192.168.30.44/32", "port": "80" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000233", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "action_parameter": "maat_scan_object", "is_valid": "yes", "and_conditions": [ { "attribute_name": "HTTP_RESPONSE_KEYWORDS", "object_name": "233_url_object", "object_uuids": [ "00000000-0000-0000-0000-000000000259" ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000234", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "Payload escape", "is_valid": "yes", "and_conditions": [ { "attribute_name": "KEYWORDS_TABLE", "negate_option": false, "condition_index": 0, "objects": [ { "object_name": "EscapeObject_234_1", "uuid": "00000000-0000-0000-0000-000000000260", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "html>\\\\r\\\\n", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000235", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "Payload escape", "is_valid": "yes", "and_conditions": [ { "attribute_name": "KEYWORDS_TABLE", "negate_option": false, "condition_index": 0, "objects": [ { "object_name": "EscapeObject_235_1", "uuid": "00000000-0000-0000-0000-000000000261", "items": [ { "table_name": "KEYWORDS_TABLE", "table_type": "expr", "table_content": { "expression": "\\(\\)abc\\^\\$def\\|", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000236", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "StringScan.HexBinCombineString", "is_valid": "yes", "and_conditions": [ { "attribute_name": "KEYWORDS_TABLE", "objects": [ { "object_name": "236_keywords_object", "uuid": "00000000-0000-0000-0000-000000000262", "items": [ { "table_type": "expr", "table_name": "KEYWORDS_TABLE", "table_content": { "expression": "cd |6162|", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000237", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "FileTest.StreamFiles", "is_valid": "yes", "and_conditions": [ { "attribute_name": "KEYWORDS_TABLE", "objects": [ { "object_name": "237_keywords_object", "uuid": "00000000-0000-0000-0000-000000000263", "items": [ { "table_type": "expr", "table_name": "KEYWORDS_TABLE", "table_content": { "expression": "处女座从学习寻找自我", "expr_type": "and" } }, { "table_type": "expr", "table_name": "KEYWORDS_TABLE", "table_content": { "expression": "亦庄", "expr_type": "and" } }, { "table_type": "expr", "table_name": "KEYWORDS_TABLE", "table_content": { "expression": "金牛座&стейк&Taurus", "expr_type": "and" } }, { "table_type": "expr", "table_name": "KEYWORDS_TABLE", "table_content": { "expression": "王守仁", "expr_type": "and" } } ] } ] } ] }, { "uuid": "00000000-0000-0000-0000-000000000238", "service": 0, "action": 0, "do_blacklist": 0, "do_log": 0, "action_parameter": "null", "is_valid": "yes", "and_conditions": [ { "attribute_name": "KEYWORDS_TABLE", "objects": [ { "object_name": "238_keywords_object", "uuid": "00000000-0000-0000-0000-000000000264", "items": [ { "table_type": "expr", "table_name": "KEYWORDS_TABLE", "table_content": { "expression": "(offset=0,depth=20)|00A12B3CEEFF|", "expr_type": "and" } } ] } ] } ] } ], "plugin_table": [ { "table_name": "QD_ENTRY_INFO", "table_content": [ {"uuid":"00000000-0000-0000-0000-000000000001", "ip":"192.168.0.1", "entry_id":101, "is_valid":1}, {"uuid":"00000000-0000-0000-0000-000000000002", "ip":"192.168.0.2", "entry_id":102, "is_valid":1}, {"uuid":"00000000-0000-0000-0000-000000000003", "ip":"192.168.1.1", "entry_id":103, "is_valid":1} ] }, { "table_name": "TEST_PLUGIN_EXDATA_TABLE", "table_content": [ {"uuid":"00000000-0000-0000-0000-000000000001", "key":"HeBei", "city":"Shijiazhuang", "is_valid":1}, {"uuid":"00000000-0000-0000-0000-000000000002", "key":"HeNan", "city":"Zhengzhou", "is_valid":1}, {"uuid":"00000000-0000-0000-0000-000000000003", "key":"ShanDong", "city":"Jinan", "is_valid":1}, {"uuid":"00000000-0000-0000-0000-000000000004", "key":"ShanXi", "city":"Taiyuan", "is_valid":1} ] }, { "table_name": "TEST_PLUGIN_LONG_KEY_TYPE_TABLE", "table_content": [ {"uuid":"00000000-0000-0000-0000-000000000001", "key":11111111, "city":"Shijiazhuang", "is_valid":1}, {"uuid":"00000000-0000-0000-0000-000000000002", "key":22222222, "city":"Zhengzhou", "is_valid":1}, {"uuid":"00000000-0000-0000-0000-000000000003", "key":33333333, "city":"Jinan", "is_valid":1}, {"uuid":"00000000-0000-0000-0000-000000000004", "key":44444444, "city":"Taiyuan", "is_valid":1} ] }, { "table_name": "TEST_PLUGIN_INT_KEY_TYPE_TABLE", "table_content": [ { "uuid":"00000000-0000-0000-0000-000000000001", "key":101, "city":"China", "is_valid":1}, { "uuid":"00000000-0000-0000-0000-000000000002", "key":102, "city":"America", "is_valid":1}, { "uuid":"00000000-0000-0000-0000-000000000003", "key":103, "city":"Russia", "is_valid":1}, { "uuid":"00000000-0000-0000-0000-000000000004", "key":104, "city":"Japan", "is_valid":1} ] }, { "table_name": "TEST_PLUGIN_IP_KEY_TYPE_TABLE", "table_content": [ {"uuid":"00000000-0000-0000-0000-000000000001", "key":"100.64.1.1", "addr_type":4, "city":"XiZang", "is_valid":1}, {"uuid":"00000000-0000-0000-0000-000000000002", "key":"100.64.1.2", "addr_type":4, "city":"XinJiang", "is_valid":1}, {"uuid":"00000000-0000-0000-0000-000000000003", "key":"2001:da8:205:1::101", "addr_type":6, "city":"GuiZhou", "is_valid":1}, {"uuid":"00000000-0000-0000-0000-000000000004", "key":"1001:da8:205:1::101", "addr_type":6, "city":"SiChuan", "is_valid":1}, {"uuid":"00000000-0000-0000-0000-000000000005", "key":"100.64.1.3", "addr_type":7, "city":"QingHai", "is_valid":1}, {"uuid":"00000000-0000-0000-0000-000000000006", "key":"100.64.1.4", "addr_type":6, "city":"GanSu", "is_valid":1} ] }, { "table_name": "TEST_IP_PLUGIN_WITH_EXDATA", "table_content": [ {"uuid":"00000000-0000-0000-0000-000000000101", "ip":"192.168.30.99-192.168.30.101", "buffer":"Something-like-json", "is_valid":1}, {"uuid":"00000000-0000-0000-0000-000000000102", "ip":"192.168.30.90-192.168.30.128", "buffer":"Bigger-range-should-in-the-back", "is_valid":1}, {"uuid":"00000000-0000-0000-0000-000000000103", "ip":"2001:db8:1234::-2001:db8:1235::", "buffer":"Bigger-range-should-in-the-back", "is_valid":1}, {"uuid":"00000000-0000-0000-0000-000000000104", "ip":"2001:db8:1234::1-2001:db8:1234::5210", "buffer":"Something-like-json", "is_valid":1}, {"uuid":"00000000-0000-0000-0000-000000000105", "ip":"2620:100:3000::-2620:0100:30ff:ffff:ffff:ffff:ffff:ffff", "buffer":"Bugreport-liumengyan-20210517", "is_valid":1} ] }, { "table_name": "TEST_IPPORT_PLUGIN_WITH_EXDATA", "table_content": [ {"uuid":"00000000-0000-0000-0000-000000000101", "ip":"192.168.100.1", "port":"0-255", "is_valid":1}, {"uuid":"00000000-0000-0000-0000-000000000102", "ip":"192.168.100.2-192.168.100.5", "port":"100-200", "is_valid":1}, {"uuid":"00000000-0000-0000-0000-000000000103", "ip":"192.168.100.1", "port":"255-300", "is_valid":1}, {"uuid":"00000000-0000-0000-0000-000000000104", "ip":"2001:db8:1234::5210-2001:db8:1234::5215", "port":"255-512", "is_valid":1} ] }, { "table_name": "TEST_FQDN_PLUGIN_WITH_EXDATA", "table_content": [ {"uuid":"00000000-0000-0000-0000-000000000201", "fqdn":"www.example1.com", "buffer":"catid=1", "is_valid":1}, {"uuid":"00000000-0000-0000-0000-000000000202", "fqdn":"*.example1.com", "buffer":"catid=1", "is_valid":1}, {"uuid":"00000000-0000-0000-0000-000000000203", "fqdn":"news.example1.com", "buffer":"catid=2", "is_valid":1}, {"uuid":"00000000-0000-0000-0000-000000000204", "fqdn":"r3---sn-i3belne6.example2.com", "buffer":"catid=3", "is_valid":1}, {"uuid":"00000000-0000-0000-0000-000000000205", "fqdn":"r3---sn-i3belne6.example2.com", "buffer":"catid=3", "is_valid":1} ] }, { "table_name": "TEST_BOOL_PLUGIN_WITH_EXDATA", "table_content": [ {"uuid":"00000000-0000-0000-0000-000000000301", "bool_expr":"1&2&1000", "buffer":"tunnel1", "is_valid":1}, {"uuid":"00000000-0000-0000-0000-000000000302", "bool_expr":"101&102", "buffer":"tunnel2", "is_valid":1}, {"uuid":"00000000-0000-0000-0000-000000000303", "bool_expr":"102", "buffer":"tunnel3", "is_valid":1}, {"uuid":"00000000-0000-0000-0000-000000000304", "bool_expr":"101", "buffer":"tunnel4", "is_valid":1}, {"uuid":"00000000-0000-0000-0000-000000000305", "bool_expr":"0&1&2&3&4&5&6&7", "buffer":"tunnel5", "is_valid":1}, {"uuid":"00000000-0000-0000-0000-000000000306", "bool_expr":"101&101", "buffer":"invalid", "is_valid":1} ] }, { "table_name": "TEST_EFFECTIVE_RANGE_TABLE", "table_content": [ {"uuid":"00000000-0000-0000-0000-000000000001", "status":"SUCCESS", "entry_id":99, "is_valid":1, "effective_range":{"tag_sets":[[{"tag":"location","value":["北京/朝阳/华严北里"]},{"tag":"isp","value":["电信","移动"]}]]} }, {"uuid":"00000000-0000-0000-0000-000000000002", "status":"SUCCESS", "entry_id":66, "is_valid":1, "effective_range":0}, {"uuid":"00000000-0000-0000-0000-000000000003", "status":"FAILED", "entry_id":11, "is_valid":1, "effective_range":{"tag_sets":[[{"tag":"location","value":["北京/朝阳/华严北里","上海/浦东/陆家嘴"]},{"tag":"isp","value":["电信","联通"]}], [{"tag":"location","value":["北京"]},{"tag":"isp","value":["联通"]}]]} }, {"uuid":"00000000-0000-0000-0000-000000000004", "status":"SUCCESS", "entry_id":66, "is_valid":1, "effective_range":{} }, {"uuid":"00000000-0000-0000-0000-000000000005", "status":"SUCCESS", "entry_id":66, "is_valid":1, "effective_range":{"tag_sets":[[{"tag":"location","value":["北京"]}]]} }, {"uuid":"00000000-0000-0000-0000-000000000006", "status":"SUCCESS", "entry_id":66, "is_valid":1, "effective_range":{"tag_sets":[[{"tag":"weather","value":["hot"]}]]} } ] }, { "table_name": "IR_INTERCEPT_IP", "table_content": [ { "uuid":"00000000-0000-0000-0000-001000000130", "is_valid":1, "effective_range":{}}, { "uuid":"00000000-0000-0000-0000-000000000161", "is_valid":1, "effective_range":0} ] } ] }