2 of 2 people found this helpful
You cannot do this because secure_binding_addresses is a list of strings, it is not a simple string, and hence you cannot match it.
The best you can do is trigger on the type and existence of the value and then examine the binding addresses in the body.
on sc := SoftwareComponent created, confirmed where type = "Microsoft IIS Website" and secure_binding_addresses exists;
found := false;
for secure_binding_address in sc.secure_binding_addresses do
if secure_binding_address matches "(?i)Auhtorit" then
found := true;
if not found then
..... rest of the body ....
Thank you very much for your help! Appreciate your time!