{ "compile_table": "COMPILE", "group_table": "GROUP", "rules": [ { "compile_id": 123, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "effective_rage": 0, "user_region": "anything", "is_valid": "yes", "groups": [ { "group_name": "group_1", "regions": [ { "table_name": "IP_CONFIG", "table_type": "ip", "table_content": { "addr_type": "ipv4", "src_ip": "10.0.6.201", "mask_src_ip": "255.255.0.0", "src_port": "0", "mask_src_port": "65535", "dst_ip": "0.0.0.0", "mask_dst_ip": "255.255.255.255", "dst_port": "0", "mask_dst_port": "65535", "protocol": 6, "direction": "double" } }, { "table_name": "IP_CONFIG", "table_type": "ip", "table_content": { "addr_type": "ipv6", "src_ip": "2001:da8:205:1::101", "mask_src_ip": "ffff:ffff:ffff:ffff:ffff:ffff:ffff:0000", "src_port": "0", "mask_src_port": "65535", "dst_ip": "0::0", "mask_dst_ip": "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff", "dst_port": "0", "mask_dst_port": "65535", "protocol": 6, "direction": "double" } } ] }, { "group_name": "group_2", "regions": [ { "table_name": "HTTP_URL", "table_type": "string", "table_content": { "keywords": "abckkk&123", "expr_type": "and", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 124, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "effective_rage": 0, "user_region": "anything", "is_valid": "yes", "groups": [ { "group_name": "group_1" }, { "group_name": "group_3", "regions": [ { "table_name": "CONTENT_SIZE", "table_type": "intval", "table_content": { "low_boundary": 100, "up_boundary": 500 } } ] } ] }, { "compile_id": 125, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "effective_rage": 0, "user_region": "anything", "is_valid": "yes", "groups": [ { "group_name": "group_4", "regions": [ { "table_name": "HTTP_URL", "table_type": "string", "table_content": { "keywords": "action=search\\&query=(.*)", "expr_type": "regex", "match_method": "sub", "format": "uncase plain" } } ] } ] }, { "compile_id": 126, "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "effective_rage": 0, "user_region": "anything", "is_valid": "yes", "groups": [ { "group_name": "group_5", "regions": [ { "table_name": "HTTP_URL", "table_type": "string", "table_content": { "keywords": "should_not_hit_any_rule", "expr_type": "none", "match_method": "sub", "format": "uncase plain" } } ] }, { "group_name": "group_6", "regions": [ { "table_name": "CONTENT_SIZE", "table_type": "intval", "table_content": { "low_boundary": 2014, "up_boundary": 2016 } } ] } ] } ], "plugin_table": [ { "table_name": "QD_ENTRY_INFO", "table_content": [ "1\t192.168.0.1\t101", "2\t192.168.0.2\t101", "3\t192.168.1.1\t102" ] }, { "table_name": "TEST_PLUGIN_TABLE", "table_content": [ "1\t3388\t99\t1", "2\t3355\t66\t1", "3\tcccc\t11\t1" ] } ] }