Sonicwall Pipeline Rules

Templates and Rules Exchange Pipeline Rules
17

Really looks like this part is just skipped

rule "Sonicwall Split IP Port Interface for src"
when
    has_field("src")
then
    set_fields(
        fields:
            grok(
                pattern:"%{IPV4:SrcIP}:%{INT:SrcPort}:%{GREEDYDATA:SrcInterface}",
                value: to_string($message.src)
            )
        );
end

image
image1938×812 38 KB

Does this look right? Should I separate Dst From Src maybe? :expressionless:

EDIT:

Yep I split and it seems to work @faen Are you using GL5? I’m trying to find the cause.How did you set the rules compliance for each stages?
Now that I split the Src part to another stage. I get the srcip BUT
It won’t split the Proto part…How many rules pert stage can I set… I’m starting (again) to be comfused here.

Thanks