All Match Rulesets vs First Match rulesets

[Stef Morrell]

Hi all,

I've been looking into an issue with scan.messages.rules which comes down to it being an all match rule, rather than a first match rule - but there are several rulesets which work on the all match basis.

Is there any harm that can be done in moving such rulesets from [All,YesNo] into [First,YesNo] within ConfigDefs.pl if the first match behaviour is more useful in any given case (and for me, especially with scan.messages.rules).

Stef