How the the rule Statement Filter logic works

[RSAAdmin]

I have a question on how the Statement Filter logic in rules works. Hope someone here can help me out. Not able to find answer on line or the online help comes with enVision.
 

On the Statement Filter page, I can do the following:

WHERE conditon A ( citeria A1 OR criteria A2 OR ... criteria An)

OR/AND  conditon B ( citeria B1 OR criteria B2 OR ... criteria Bn)

OR/AND  conditon C ( citeria B1 OR criteria C2 OR ... criteria Cn)

....

OR/AND  conditon D ( citeria 1 OR criteria 2 OR ... criteria n)

Note that I just put OR/AND for the logic operator choices instead of the whole shebang to improve readibility.

I assume that implementing the logic "A | B | C & D" is just configuring the conditions from the top down. I may be wrong here. But if it's just a WHERE clause in SQL, this should be true.

In the other words, the screen should show:

WHERE conditon A ( citeria A1 )

OR      conditon B ( citeria B1 )

OR      conditon C ( citeria C1 )

AND     conditon D ( citeria D1 )

But how can I implement the logic "(A|B) & (C|D)"? It does not support parentheses.

I have a rule which needs a Statment Filter to fire on a number of OR conditions but they all have to satisfy an unique condition for all situations.

This is very simple if parentheses is supported. The logic would be "(A|B) & !C". I just tried the following in enVision to see if it works. No it does not, the rule still fires.

WHERE [Source address] IN [xyz]

OR      [Destination Port] IN [abc]

AND     [Source port] NOT IN [mnp]

The intent of this filter is to fire alerts when source address is xyz or destination port is abc  but only when the source port is not mnp for all situations.

Thanks in advance

[RSAAdmin]

I have also asked RSA for a means to "group" conditions in the rule filters. 

Here is a response I got once about a question on rule filters...see if this helps:

When Source IP1 =1.1.1.1 AND Source IP2=1.1.1.2 OR SourceIP3=1.1.1.3 and SourceIP4=1.1.1.4, in this case we have four sub filters(F1,F2,F3,F4) and they are defined as F1 AND F2 OR F3 AND F4

If F1 and F2 matched  or F3 and F4 matched then it will fire alert because there is a OR  after F2. If it was AND then when all F1, F2, F3, F4 matched then it will fire alert.