I want to create an exclusion condition for an alert based on the values of multiple fields using YARA-L and a data table

You could concatenate both strings in 1-field then use the concatenated field with any condition.

Thank you for your reply.
Let me confirm what you said.
Does that mean defining field joins in the parser? Or can they be joined using rules?

You could define the table as ;

First column will be the ip-email pair concatenated with “_”, the other column is any dummy value.

The rule should be like ;
 

rule sample_rule {

  meta:

  events:

    $e.metadata.log_type = "GCP_CLOUDAUDIT"

    $user_id_for_match = $e.principal.user.userid

    $e.principal.ip != ""

    $e.principal.user.email_addresses !=""

    strings.concat($e.principal.ip[0],"_",$e.principal.user.email_addresses[0]) = $ipEmailPair

    %sample_rule3.ref = $e.metadata.log_type //dummy match just to allow “!=” operator later

    $ipEmailPair != %sample_rule3.ipEmail

  match:

    $user_id_for_match over 1h

outcome:

        $ipEmailPair_ = array_distinct($ipEmailPair)

  condition:

    $e 
}

The rule will generate a list of IP Email pairs ($ipEmailPair_) per user id ($user_id_for_match), but also the rule will trigger if the list $ipEmailPair_ have any pairs that are not in the table.

i.e. if you added ip1_email1,”GCP_CLOUDAUDIT” in that table, the rule will trigger if a user id user1 has ip2_email2 and ip1_email1pairs within the hour since ip2_email2 pair is not in the data table.

Thank you for your reply.
I will try to verify the information you provided!
I will contact you once the verification is complete.

I tested it and was able to achieve what I wanted to do.

Thank you for your response!