On Wed, 2010-03-17 at 13:26 -0500, Gary wrote: > Ok, I'll figure out a URI body rule from some examples on the SA website. > You're looking at this sort of pattern:
uri RULENAME /(url1|url2|url3)/i and don't forget to escape dots in the URL ( replace . with \. ), but be warned, this approach tends to turn into a game of wackamole, so keep a careful eye out for patterns that can turn into a regex, e.g, a month or two back there were a lot of autogenerated URLs being used that all mapped onto something like www\.[a-z]{3}[0-9]{5}\.(com|net) Martin