Multi-event modifier (event-match-multiple
)
The multi-event modifier (event-match-multiple
) matches a range of
event types and then modifies them as specified by the pattern-id
parameter and
the capture-group-index
parameter.
This match is not done against the payload, but is done against the results of the EventName matcher previously parsed out of the payload.
This entity allows mutation of successful events by changing the device event category,
severity, or the method the event uses to send identity events. The
capture-group-index
must be an integer value (substitutions are not
supported) and pattern-ID must reference an existing pattern entity. All other properties are
identical to their counterparts in the single-event modifier.