cancel
Showing results for 
Search instead for 
Did you mean: 
eaanders
Level 7

Is there a way to clear the List.LastMatches property

I am using MWG 7.5.2 and have some sequential rules that leverage the List.LastMatches property.  As each rule checks for an finds entries in lists, it appends the last matched entry into List.LastMatches.  I need to access only the most recently matched item from a list (or the last entry in List.LastMatches).  What is the best way to do that?

0 Kudos
6 Replies
Peacekeeper
Level 20

Re: Is there a way to clear the List.LastMatches property

Moved to Web Gateway

0 Kudos
McAfee Employee

Re: Is there a way to clear the List.LastMatches property

HI Eaanders!

I tested this (on 7.5.2.4) myself and was not able to get List.LastMatches cleared out. I had thought it cleared out on its own after the rule executed or the next list was evaluated.

Did you by chance have an SR open with support? If you do, I can open a research case with development to understand the reasoning and to see if there might be a way to achieve what you want.

, did you have any thoughts on this one?

2016-02-12_080414.png 2016-02-12_080337.png

2016-02-12_080654.png 2016-02-12_080705.png

Best Regards,

Jon

0 Kudos
asabban
Level 17

Re: Is there a way to clear the List.LastMatches property

Odd... I was pretty sure it will only save the "Last" match, rather than all matches in a list. I will check what we can do.

Best,

Andre

0 Kudos
eelsasser
Level 15

Re: Is there a way to clear the List.LastMatches property

'matches in list' or 'is in list' do not clear the previous entries. This was apparent when I saw remnants of a URL.Category match that occured prior to my test rules, but remained in List.LastMatches.

If I use 2 consecutive SmartMatches using string lists, the List.LastMatches doesn't append to a previous match. SmartMatch resets the List.LastMatches before it add the entry. Try using that instead as a quick fix.

Since the current match seems to always be at the end of the List.LastMatches, you can capture just the last entry like this:

Events:
Set User-Defined.List.LastMatches.Save(List.OfString) = String.ToStringList (List.LastMatches, ",", " \t\r\n")
Set User-Defined.List.LastMatches.Size(Number) = List.OfString.Size (User-Defined.List.LastMatches.Save)
- 1
Set User-Defined.This.List.LastMatches(String) = List.OfString.Get (User-Defined.List.LastMatches.Save, User-Defined.List.LastMatches.Size)

This will pull the last entry into User-Defined.This.List.LastMatches

Hope that helps.

0 Kudos
eaanders
Level 7

Re: Is there a way to clear the List.LastMatches property

Hi Erik,

That is EXACTLY what I had done to get it working.  I believe that the behavior of List.LastMatches changed sometime recently as I had built some proof-of-concept rules to handle some web request processing.  It worked as we all expected then (only contained the most recent match) but when we started full testing, it all broke and I noticed the appending going on.  I have not looked through the change logs yet because I am not sure where to find them. 

While I can see that it would be useful to track all matches along the way, a string of comma-separated values is difficult to manage and a list of string would be more appropriate.  Even then a property that contains the single most recent match would be great.

I do not have a SR open yet, but I can create one if that will help.

BTW, somewhat related is another issue we came across with a list of IPRanges containing CIDR notation.  The List.LastMatches will contain a string showing an IP range rather that the CIDR.  Based on some other testing I have done, I believe this expansion occurs as part of the IPRange to String conversion.  This is also causing some difficulty because I am using the match from a list as a key to find a corresponding value from a Map in a subsequent rule.  So, we are looking for ways to deal with that too:

1) see if IPRange lists will accept IP range notation (eg, "10.10.1.1-10.10.1.1" instead of  "10.10.1.1/32") to store its elements so it is consistent

2) modify our code to store the IPRange elements as CIDR and store the map key as range strings.

I can start another thread to discuss but it was related so I thought I'd mention it here.

Thanks,

Emory

0 Kudos
asabban
Level 17

Re: Is there a way to clear the List.LastMatches property

Hello,

I agree that I think the behaviour has been different in the past. I am in touch with dev to find out more.

Best,

Andre

0 Kudos