Add more options for matching task headers

[ups1decyber]

I'm trying to keep this short, but I think I need to describe our use case for this to make sense.

We have a custom Karton for Yara matching that adds the names of matched Yara rules to the task headers to allow certain Kartons to receive samples based on matched rules. Because lists are currently not supported in task headers, we stringify the list of matched rules: ",".join(matched_rules).

To make things work, the receiving Karton's filters have to look like this:

[{
  "yara": "*my_rulename*"
}]

This seems to be a rather unintuitive way of writing a filter. However, things become worse for more complex conditions sich as checking if multiple Yara rules matched.

So my proposal is to add more complex filters. For example as such:

[{
  "yara": {
    "contains": ["my_rule1", "my_rule2"],
    "!contains": "my_rule3"
  }
}]

So basically the idea is to utilize dictionaries that contain 'relationship keywords' as keys and have a single value or a list of values as items (depending on the relationship).

For now, I could imagine the following relationships:

Relationship	item type	description
contains	single value or list of values	Assumes that the given header field is a list, otherwise defaults to condition not met. Checks if all given values are contained in the list that corresponds to the task header item.
!contains	...	Same as before, but none of the list items must be in the task header.
in	list of values	Checks if the header value is contained in the specified list. If the header value is a list, then all values must be contained in the specified list.
!in	...	...
>, >=, <, <=	single value	for numerical comparison

Let me know what you think of this idea :)

[ups1decyber]

One more thing: If you want this feature in Karton, I can assist with the implementation and provide some code