hi thanks

this means i have to make a line for each ip adr i want to drop then?

its not possible to list the DestinatioIP that i want to drop like

...
    - or:
           - equals.event_data.DestionationIp: [ '40.101.48.82', '40.101.65.130' ]

i think that is what you are getting at, just wanted to be sure ;)

---