diff --git a/core/lib/rules.py b/core/lib/rules.py index 7e2c67a..5619b7e 100644 --- a/core/lib/rules.py +++ b/core/lib/rules.py @@ -76,6 +76,18 @@ def process_rules(data): break # Continue to next field continue + + # Allow partial matches for msg + if field == "msg": + for msg in value: + if "msg" in message: + if msg in message["msg"]: + matched_field_number += 1 + matched_fields.append(field) + # Break out of the msg matching loop + break + # Continue to next field + continue if field in message and message[field] in value: matched_field_number += 1 matched_fields.append(field)