Improvment/scenarios: sequence of scenario

[AlteredCoder]

Is your feature request related to a problem? Please describe. I would like to trigger a scenario when a sequence of event occurs

Example of what you imagine I think a configuration file that looks like this can be a solution:

type: sequence
name: vist_uri_1_or_2_and_3
sequence:
 - seq_1:
 	type: leaky 
 	filter: evt.Parsed.uri == "1"
 	capacity: 3    # visit minimum 3 products page
 - seq_2:
 	type: trigger  # visit a specific page
 	filter: evt.Parsed_uri == "2"
 - seq_3:
 	type: trigger
 	filter: evt.Parsed_uri == "3"
condition: (seq_1 or seq_2) and seq_3
group_by: ip_addr
timeframe: 60s     # those 3 events should occurs in 60seconds

[ghost]

One question though: Does the sequence has to be in order ?

[AlteredCoder]

I think yes

[opendba]

This sounds like a great idea and would allow to catch complex attacks.

[buixor]

Conditional buckets have been merged in 1.5.0 and solves this need :smile: