World of EUC

It was bit of a surprise ChatGPT could write those expressions, but well... pretty handy also.

It helps me when I am stuck in powershell aslo.

One thing I learned, If you take the error and put it back in ChatGPT it will correct the script

I said before, it my personal virtual <@ULJM9DQF2> lol

not a native English-speaker, so this brings in an extra layer of challenge

Let me know if I said something that was confusing and I can explain it better

`(!HTTP.REQ.HEADER("hash").EXISTS) || (HTTP.REQ.HEADER("hash").EXISTS &amp;&amp; (!HTTP.REQ.HEADER("authkey").EXISTS&amp;&amp; !HTTP.REQ.HEADER("token").EXISTS))`

two checks
1. the "hash" needs to be always present

2. if the hash is present, then either "authkey" or "token" needs to be present also

image.png

I don't see how your last expression would be ok though  --&gt; depending if it can validate as true if hash is not present.  You say it always has to be present so the first || is weird to me ?

uhm...

*(!HTTP.REQ.HEADER("hash").EXISTS)* || _(HTTP.REQ.HEADER("hash").EXISTS &amp;&amp; (!HTTP.REQ.HEADER("authkey").EXISTS&amp;&amp; !HTTP.REQ.HEADER("token").EXISTS))_

The bit in bold makes sure that if "hash" is missing, I'm always getting a hit and the bit in cursive makes sure, that if "hash" is found, but either "authkey" or "token" is missing, I'm getting a hit

my postman requests to that responder rule seem to trigger the log action as expected

not the first nor the last time I run in to trouble with these

yeah it depends on when you want  a hit I guess, since you specified in the beginning that you want to detect when it is present I was figuring you were building a NOOP action with this rule and a drop or whatever on true after that for example. you're just doing a negative policy while I thought you wanted a positive one from your first example :slightly_smiling_face:

the idea is to eventually allow requests to pass only if "hash" is present and either "token" or "authkey" is present

so the screenshot I posted does exactly that if you NOOP that one and put a DROP all below :eyes:

I got it working with one policy (above) so I'll go with that one