On 7 Dec 2018, at 8:33, RW wrote:
On Thu, 06 Dec 2018 14:32:37 -0500 Bill Cole wrote:You cannot get multiple hits from an ALL rule because the regex is matched against the whole block of headers. Once it matches, the test is done.Just for the record, that isn't a limitation of "multiple"
Right. It's inherent in the logic of the "ALL" pseudo-header: an aggregate of all headers, not an array of discrete headers.
