# XML

<mark style="color:green;">**XML Match Rules**</mark> are designed for detecting threats or patterns within structured data sources that use XML formatting. This rule type is ideal for processing feeds, form submissions, third-party alerts, and content with hierarchical tagging such as threat reports, leak disclosures, or machine-readable submissions.

These rules allow analysts to define precise conditions over specific XML nodes, attributes, or values. They support <mark style="color:green;">**regular expressions (regex)**</mark> for flexible pattern matching within content and provide fine-grained control over structured data inspection.

***

### Rule Structure

Each XML rule includes:

* <mark style="color:green;">**Target Element(s)**</mark>\
  The XML node or attribute to inspect (e.g., `<email>`, `<domain>`, `@type`)
* <mark style="color:green;">**Condition**</mark>\
  Logic defining what should be matched. Conditions can include:
  * Exact value match
  * Partial string match
  * **Regex match**
* <mark style="color:green;">**Severity**</mark>\
  Optional impact classification (`low`, `medium`, `high`)

### Regex Support

Regex can be used to:

* Identify email domains, credential patterns, or encoded values
* Detect naming conventions in tags or attributes
* Match variations in formatting across data sources

Regex is defined inside `<condition>` and supports common expressions such as:

```xml
<rule>
  <condition regex=".*unauthorized\s+access.*" />
  <severity>high</severity>
</rule>
```

***

### Use Cases

* Flag indicators in external CTI feeds
* Match credentials or tokens in structured breach dumps
* Detect abuse types in standardized incident formats (e.g., STIX, TAXII)
* Monitor custom fields in partner submissions or open disclosure reports

***

### Incident Triggering

When an XML Match Rule finds a match in newly ingested structured content, the result is classified and enriched. If it meets the predefined criteria, it triggers an <mark style="color:green;">**incident in the Response module**</mark> automatically.