<< Click to Display Table of Contents >> Navigation:  Event and Object Analysis > Capture Results Filtering > Prefiltering HTTP Requests > Conditions > TAG Condition

Checks if a tag is set and gets the value of the tag's counter (refer to "TAG Action" section).

Description

This condition checks the specified tag's activity for an object and the level of this tag.

Format

<c name="tag" tag="<tag name>" op="<operation>" value="<compare value>" />

The "name" attribute:

The name attribute specifies the name of the condition - name="tag".

The "tag" attribute:

The tag="..." attribute specifies the name of the tag to check.

The "op" attribute:

The op="..." attribute specifies the type of comparison. Possible values:

eq or = or ==

True if the value is EQUAL TO the specified value

ne or != or <>

True if the value is NOT EQUAL TO the specified value

lt or <

True if the value is LESS THAN the specified value

gt or >

True if the value is GREATER THAN the specified value

le or <=

True if the value is LESS THAN OR EQUAL TO the specified value

ge or >=

True if the value is GREATER THAN OR EQUAL TO the specified value

exist

True if the tag exists (has already been set for this HTTP object)

By default (if the op attribute is missing), "exist"is used. For the "exist" operation, there's no need to specify the "value" attribute.

The "value" attribute:

The value="..." attribute specifies the value to check in case the value is a tag counter.

Example

<c name="tag" tag="SPAM" op="exist" />

or

<c name="tag" tag="SPAM" />

True if the object is tagged as SPAM.

<c name="tag" tag="SPAM" op=">=" value="3" />

True if the object is tagged as SPAM and its counter value is greater than or equal to 3.

Example

Detect requests with bad words (satan|shopping|dating|movies|hexogen), mark them with the shopping tag. Ignore requests marked as shopping.

<?xml version="1.0" encoding="utf-8"?>
<filter name="HTTP filter" version="1.0">
 <comment>HTTP filter.</comment>
 <table name="main">
 
   <rule enabled="true">
     <comment>
       Detect requests possibly related to bad things.
     </comment>
     <match>
       <c name="url"
          op="re"
          value="satan|shopping|dating|movies|hexogen" />
     </match>
     <action name="tag" value="shopping"/>
   </rule>
 
   <rule enabled="true">
     <comment>
       Ignore a request tagged as "shopping".
     </comment>
     <match>
       <c name="tag" tag="shopping"/>
     </match>
     <action name="drop" />
   </rule>
 
   <rule enabled="1">
     <action name="accept" />
   </rule>
 </table>
</filter>