Chris Santerre wrote:
> Long answer: Multiple meta rules. Take to much computational effort.
> The regex isn't slick for these type of rules either.

The multiple meta rules are the easiest approach to doing this.  I have a
number of rulesets which use this trick to count different things.  Not
exactly count the occurance of the same thing, but to combine when multiple
keywords are in the same e-mail message.  Porn rules, spam rules, subject
obfu rules, etc.

Example:
body  __rule1 /test/i
body  __rule2 /test2/i
body  __rule3 /test3/i

meta  __has_1ormore (__rule1 + __rule2 + __rule3) > 0
meta  __has_2ormore (__rule1 + __rule2 + __rule3) > 1
meta  __has_3ormore (__rule1 && __rule2 && __rule3)

meta  RULE_HAS_1 (__has_1ormore && !__has_2ormore)
meta  RULE_HAS_2 (__has_2ormore && !__has_3ormore)
meta  RULE_HAS_3 (__has_3ormore)

score  RULE_HAS_1  1
score  RULE_HAS_2  2
score  RULE_HAS_3  3

Reply via email to