We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
concat(<item1>, <item2>, ...)
Motivation
Please look at this comment for context.
The concat(<item1>, <item2>, ...) transformer concatenates items (either a field or a literal string) given as arguments and returns a new string.
Its output can be utilized in two primary ways:
output:
One significant use case is concat(fd.rip, ":", fd.rport) in ("8.8.8.8:53","4.4.4.4:53") as reported by #1981
concat(fd.rip, ":", fd.rport) in ("8.8.8.8:53","4.4.4.4:53")
Feature
Implement the concat(<item1>, <item2>, ...) as described above. The transformer should return a concatenated string.
Note: Implementing this transformer requires extending the current syntax to allow a variable number of arguments to be accepted by a transformer.
Alternatives
Please look at #1981 for more context on the evaluated alternatives.
The text was updated successfully, but these errors were encountered:
/assign
Sorry, something went wrong.
join(<list>, <sep>)
therealbobo
No branches or pull requests
Motivation
Please look at this comment for context.
The
concat(<item1>, <item2>, ...)
transformer concatenates items (either a field or a literal string) given as arguments and returns a new string.Its output can be utilized in two primary ways:
output:
field of Falco's rule.One significant use case is
concat(fd.rip, ":", fd.rport) in ("8.8.8.8:53","4.4.4.4:53")
as reported by #1981Feature
Implement the
concat(<item1>, <item2>, ...)
as described above.The transformer should return a concatenated string.
Note: Implementing this transformer requires extending the current syntax to allow a variable number of arguments to be accepted by a transformer.
Alternatives
Please look at #1981 for more context on the evaluated alternatives.
The text was updated successfully, but these errors were encountered: