I'm trying to write a rule that matches both the name of a header and its value. I've had no luck so far, can somebody point out my mistake?
My current attempt is: header __GS_PHP_ORIG ALL =~ /^X-PHP-Originating-Script: [0 -9]+:(Mailer|Sendmail|Api).php/i An example line is: X-PHP-Originating-Script: 20039:Api.php Thanks, Geoff