Multiple <match> as an 'AND', not 'OR'

[Bruce Westbrook]

Running OSSEC v2.8.3

Can we create a custom rule that performs multiple <match> as an 'AND' ?  I need to match multiple, non-contiguous patterns from the log portion.  

For instance, a Windows event log comes in with the following log data:

2018 Jan 22 23:59:54 WinEvtLog: Security: AUDIT_FAILURE(4776): Microsoft-Windows-Security-Auditing: (no user): no domain: dc.domain.local: The domain controller attempted to validate the credentials for an account. Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Logon Account: USER-A Source Workstation: WORKSTATION-A Error Code: 0xc0000064

Taking this example, I need to match BOTH "USER-A" and the source workstation "WORKSTATION-A" for a custom rule.  However, if "USER-A" is on a different source workstation, I don't want the rule to fire, so I need to match both items specifically.

As far as I can tell the <match> only has an 'OR' using the pipe '|'.

How would I do multiple matches in the log content like this?

[dan (ddp)]

Can you setup a parent and child rule for this?

> --
>
> ---
> You received this message because you are subscribed to the Google Groups
> "ossec-list" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to ossec-list+...@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

[Bruce Westbrook]

Yup, that's actually what I did to make it work.  I was hoping I was just overlooking something to make a single rule using an 'AND' type statement.