I know that in a Log Decoder Service, the log processing sequence is like:
Parsers --> Rules --> Feeds
but, I need to create an App Rule to generate meta based on other meta generated by a custom feed.
The use case is as follows:
I got a user.src and search that username in a custom feed. The feed enrich that meta with a new one: user.src.name. I want to generate an alert meta when in a log I got user.src but not user.src.name.
any ideas?
I believe feeds are applied before App Rules. Feeds should be applied right after the parsing stage, so you're able to refer to meta generated by them in App Rules. Note that App Rules are run in top-down fashion, like a firewall rule chain, so app rules can even refer to other app rules as long as they're placed below them in-order.