Guide to Using Contexts in XKS Fingerprints

SEGRETHGGIMINTHREL TGI USA, AUS, GAN, GER, NZL Guide ta using Cantexts in XKS Fingerprints Versian 1.[i Example 1 $a cct'pk'} and ar far jihad'}} De?nitian Gantextual expressians are thase that restrict the search space far a particular expressian. In example 1 abay'e, we are leaking far the string ?jihad? anly in the narmalised text af a web search, and ?planning far jihad? anly in the cantext cf the UTF-8 narmalised text af an affice dacument. GENESIS pray'ides a number af different cantext types depending an the functian cf the cantext: I hash exact match scan perfarm a kejasardfregex scan an cantextual text latlang [geabax) perfarm an R-tree geabax laakup an the latlang lacatian prefix matches the langest prefix cf the cantext and tasked term appid??ngerprintrtapic triggers based an appids, fingerprints, and tapic lagic extracted jile allaws haaking an raw extracted f?es transmitted an the netwark Technical Nate (UHFDUD) The difference bemeen a ?hash? and a ?scan? cantext is that ?scan? means that afall keysnurard scan will be executed against that cantext's data which means the keysnrard will still hit if it's a sabstring at a larger ward (think at it as being wildcarded an bath ends]. A hash laakap must be an exact match which is much faster and less taxing an frant-end resaarces. Far example, web_search is a scan sa will hit an web searches like: want ta participate in jihad? ?Haw da I avaid jihad? ?jihadi? ?bigjihad? What is llantexmal Lagic? (SHREL) Gantextual lagic is the ability ta laak far keywards, regular expressians, gea- baxes, and ather events purely within a specified a scape [cantext). While this may act saund like a big deal, currently the anly cantext that current DN I pracessing sensars praside is that af ?strang-selectar? where an email handlefip address is extracted fram a knawn applicatian type and lacked up against a list af knawn targets. Derived Pram: NSAEGSSM L52 Dated: EDWDIDS Declassify Dn: 2D35?2?l TD USA, AUS, CAN, GER, NZL

TGI USA, ALIS, CAN, GER, NZL Gentestual legie allews the ereatien ef advaneed analytics with extreme preeisien. Fer example, if as an analyst needs te find all peeple in Kabul perferming web searches en Jihad, hew eeuld this be dene? Fer starters, tasking the term Jihad in GADEN GE er ether similar systems weuld result in velumineus eelleet as the keywerd hit en every news web page, bleg entry, RSS feed etc. The result weuld be a ten ef data that weuld ultimately be useless te the analyst and waste esfil bandwidth. Se whe eeuld I ask the questien ?Shew me all the peeple deing web searches en Jihad frem Kabul?" Well fer starters, the system weuld need te understand web searches. What is used fer relaying the test ef a search frem yeur brewser te the search site?s data centers? The system must net enly be capable ef identifying this traffic, but alse ef it and estraeting eut the test ef the web search. Well it tums eut that mest search engines uses the HTTP [just like every ether web site eut there) and the search terms are url-eneeded and are passed as the url argument XKEYSGGIRE [er ether equivalent system) will extract the url argument and then nermalise the test by it. After nermaliaatien, the test is passed te the GENESIS eenteat fer seanning against all search terms SA are leeking fer. Se this is hew we weuld task the web search: er ?mejahadeen?j But wait we?re net dene yet. The analyst requested that the espressien enly be true if the persen was physically leeated in Kabul. Te execute the geegraphie this part ef the questien, the GENESIS engine perferms an NKE IPGEGI leekup against all sessiens. The eeuntry and city eedes are then passed te the eenteats relating te eeuntry and City. The City eede tasking fer Kabul w?l fire. This is the up dated fingerprint: er ?mejahadeen?j and cityt?Kanul?l; Se new, we have the web-seareh eenteat fer Jihad firing, and the city tasking fer Kabul firing. Eeth ef these events are then eembined in the GENESIS engine?s Beelean evaluater where the is evaluated and the resulting fingerprint fired, tagging the sessien as being petentially interesting. This is a very simple example, but very pewerful. The eeneept ef gives pewer that was never pessible with GADEN GE. It allews the tasking ef eembinatiens ef seft terms in that tegether ferm a very streng event. TG USA, HUS, CAN, GER, NZL

TD USA, AUS, CAN, GER, NZL What is the syntax for Contextual Logic The syntax for contexts is: (UHFDUD) Contexts themselves are Boolean expressions that allow composition of expressions involving the use of many contexts. The example in the previous section demonstrated this use, which is very natural: or ?mojahadeen?j and oityt?Kabul?); Technical Note (SHE EL) You may not compose expressions that include one oontext inside of another. For example the expression or is somewhat meaningless and not permitted. Dynamic Contexts (UHFUUD) Dynamic contexts in GENES IS are those that can be expressed by regular expressions. For example, if you wanted to write expressions that operated on the HTML title of a web page only and GENESIS didn?t have a pre-defined context to serve this purpose [it does), then you could write the following expression: my_html_title scan and ?making?l; The first expression defines a context named ?my_h tml_title?. The type of the context is ?scan? i.e. perform a keyword scan of tasked terms against the extracted text. The fingerprint makes use of the dynamic context by looking for the keywords ?bomb? and ?making? within the context of the extracted HTML title. Here is another example this time a dynamic expression for Yahoo chat: yahoo_ohat_notify hash TD USA, AUS, CAN, GER, NZL

TU USA, AUS, CAN, GER, NZL fingerprintt?badgny?} In this case, we have given two regular expressions that will perform extraction against the data stream. The type of the context is ?hash? meaning that the extracted text will be leaked up in a hash table in that hash table w?l be any tasking applied to that context, in this case ?badguy? has been used in that context below. Technical Note (SHREL) Notice that in the yahoo_chat_notify example above the following the regular expressions. It is a requirement that all expressions should have the same case sensitivity setting. The same requirement applies for contexts of type ?hash?. The case sensitivity applied not only to the regular expression mnning against the raw traffic but also the actual lookUplscan of the extracted text against terms tasked against that context. Advanced lilontexts Context presence Sometimes the presence of a context in traffic is all we need. For example, if the GENESIS is to be used to filter traffic being forwarded to a site- store, we may want to pass all Chat sessions from Mumbai to Pakistan that have content. Anyone who has looked at chat traffic very quickly realises that there are volumes of presence messages sent, much of which are not that interesting, and then there is the chat that has content. How could we find all traffic with actual chat content? Well we have a ?Chat_body" context, but how do I task ?not null" in reference to a particular context? Well a hack would be to task ?chat_body[not then every chat session that does not contain the word ?junk? will be selected, however that is not a very elegant solution, and in fact is very inefficient. GENESIS allows tasking of a not null simply by providing an empty context as follows: fingerprint[?mnmcaifchat?l cct?pk?l and cityt?mnmcai?l and chat;cody[l; Appendix A Context Catalog File Transfers filename Description: TD USA, AUS, CAN, GER, NZL

TD USA, AUS, CAN, GER, NZL Eyery I1th nermalixed filename seen in traffic is passed te this eentext. Examples are (but net ]imited te) files transmitted in EMTP, PDPE, IMAP, HTTP Eespenses, HTTP Pests, ETP sessiens, and MllyiE?eneeded header. Nete that the filename refers te just the filename and net the entire path+filename. Aliases: fna me Centext Type: Full Sean Eample: file name 1wimax. {13,313 }setupf) file_ext Deseriptien: Eyery utf?B nermalixed file extensien seen in traffic is passed te this eentext. Examples (but net ]imited te) are files transmitted in SMTP, PCIPB, IMAP, HTTP Eespenses, HTTP Pests, FTP sessiens, and Mh?eneeded header. Aliases: ext Centext Type: Hash Eample: ?lexarips' aw ?ist path Deseriptien: Eyery utf?B nermalized file path seen in traffic is passed te this eentext. Examples are (but net ]imited te) files transmitted in SMTP, PCIPE, IMAP, HTTP Eespenses, HTTP Pests, FTP sessiens, and h?MEeneeded header. Aliases: dir Centext Type: Full Sean Eample: pathUDeeume nt and Settings?Ma er ?fhemeftestj HTTP Activity weh_seareh Deseriptien: The nermalized extraeted text frem web searches. The system extraets search terms Geegle, Miereseft, News sites and search term leakage frem the Referer line ef HTTP headers. In additien it will extract and use spelling eerreetien the HTML seryer respense se if the target mis?spells but the search engine eerreets the expressien will still eyalnate true. TD USA, AUS, CAN, GER, NZL

TD USA, AUS, CAN, GER, NZL Aliases: sea reh Cnnteat Type: Full Sean Eanlple: weh_sea reh[? ric'tn? ar plague Deseriptinn: The narntah?zed extracted test web page titles. Aliases: http_tit1e Contest Type: Full Sean Eanlple: tal and ?hernh?) http_url Deseriptinn: Every URL hunt HTTP GET and PEST cantntands. Aliases: url Cnnteat Type: Full Sean Eanlple: http_url_args Deseriptinn: arguments given as part at a URL (1e. a]l test fa?awing the in a URL string) Aliases: url Cnnteat Type: Full Sean Eanlple: http_hnst Description: The ?Hash? name given in the header. Aliases: TD USA, AUS, CAN, GER, NZL

TD USA, AUS, CAN, GER, NZL Context Type: Fu? Scan Eanlple: http_host[? yahoo.con1?) http_senrer* Description: The type name in the header. Aliases: inane} Context Type: Fu? Scan Eanlple: http_host(? CWSIZ. 1? or ?Apache http_referer* Description: The ?Referee? URL given in the HTTP header. Aliases: {none} Context Type: Fu? Scan Eanlple: http_language Description: The normah?zed two letter lad?5393 language code as inferred from any and or header info. Aliases: {none} Context Type: Fu? Scan Eanlple: http_1angua ge[i fa or ?de http_1angnage[not http_cooltie Description: (momma) The ?Cookie? field given in the header. Aliases: {none} TD USA, AUS, CAN, GER, NZL

TD USA, AUS, CAN, GER, NZL Contest Type: Fqu Scan Eanlple: http_coohie [f http_user_agent GEO Info Description: The ?User?Agent" field given in the header. This is the name of the hrovvser the c]ient is using [eg Firefos, or Internet Explorer). Aliases: use r_age nt http_hrowser browser Contest Type: Full Scan Eanlple: http_user_a gentUIvIoziJlavT-d?h or ?Chro nte rnap_latlong Description: A geo has around the location of a map view zoom on services such as [Boogie Earth, Google Maps, Microsoft Live Earth etc. Aliases: ntap, map_aoont, soont Contest Type: latlong hos Eanlple: 2, 3, Description: The destination country based on IP address IPGED loohup. Aliases: ip_to_cc Contest Type: Hash Eanlple: or from_cc TD USA, AUS, CAN, GER, NZL

CE TD USA, AUS, CAN, GER, NZL Description: The sduree eauntry hased an IP address IPGED ladhup. Aliases: ip_frd m_ee Cantest Type: Hash Eample: dr Deseriptian: The eauntry [either ta CIR tram) hased an IP address ?IPEECI1erahup. Aliases: ip_ee Cantest Type: Hash Aliased ta frdm_ee and td_ee. Eample: ee(?ir? dr iph?) te_latlang Deseriptien: A gee has ardund the destinatidn latitude and langitude hased an IP Address IPEED lac-Imp. this centeart is eurrertdy disahfed fer perfermanee Aliases: inane} Cantest Type: has Eample: 2, 3, framJatlang Deseriptien: A gee: has ardund the sduree latitude and langitude hased an IP Address IPEED lddhup. NQTE this centeart is eurrendy disubfed far perfermrmee Aliases: snanea Cantest Type: has Eample: 2, 3, TD USA, AUS, CAN, GER, NZL

latlang ta_e ity TD USA, AUS, CAN, GER, NZL Deseriptian: [Sift?{EL} A gee bas araurtd the sauree ar destinatian latitude and langitude based an IP Address ?IPGED1aahup. NQTE this centeart is eurrendy disubfed fer perfermrmee Aliases: inane} Cantest Type: latlang be}: Ahased ta fram_1atlang and ta_1atlang. Eample: latlangfl, 2, 3, Deseriptian: The destinatiart city based an IP address leahup. Aliases: Cantest Type: Hash Eample: fram_eity city Deseriptian: The sauree City based an IP address IPGED lee-1:11p. Aliases: fram_tdwn Cantest Type: Hash Eample: fram_etty[? Islamabad Deseriptian: The sauree ar destinatiart City based an IP address IPGED laahup. Aliases: fram_tdwn Cantest Type: Hash Aliased ta fram_eity and ta_eity. Eample: Islamabad TD USA, AUS, CAN, GER, NZL

TD USA, AUS, CAN, GER, NZL Metadata sigad Deseriptiun: The site designate-r Aliases: inane} Sean Eample: sigad[?US?1234?) easenntatinn Deseriptiun: The enlleetidn site easenetatinn [signal designatdr). Aliases: ease_ndtatidn Sean Eample: easenutatien[?ABC 1234?) hlnelt_num Description: The sessidn hldeh number. If a TCPIIP sessidn exceeds a maximum size [typriealltr the sessidn is fragmented and assigned a une?up nun?aerd hldeh number. If a sessidn is black aerd it is the dne and only fragment. Aliases: hldeh Sean Eample: sigint_heatler Deseriptiun: The tasked eapressiun will hit an terms in a SIGINT header, and net in the had},r at the enmmunieatiens. Aliases: header Sean Eample: TD USA, AUS, CAN, GER, NZL

TD USA, AUS, CAN, GER, NZL and sigint_h ndy Description: The tasked espressian 1will anly hit an terms in the eammnnieatians eantent and net in ar [irate-eel headers. Aliases: hddy Contest Type: Sean Eample: and sigint_h ndy Deseriptinn: The tasked espressian 1will anly hit an terms in the eammnnieatians content and net in ar prataeal headers. Aliases: hddy Cantest Type: Sean Eample: and realm Deseriptinn: The seleetar and its realm. The syntax far this is in the standard farm df ?hadguysyahda?a? where ?hadguy? is the usemame and ?syahaa?a? is the realm. realmO tasking is Aliases: inane} Contest Type: Hash Eample: realm[?had guysyahaa?a?) streng_seleetnr Deseriptinn: Autamatieally attempts ta determine realm [selectar eauld he email address, eaakie ar ether) and then creates permutatians ta task in the main seanner engine far the given target. Given the number df permutatians far a single TD USA, AUS, CAN, GER, NZL

TD USA, AUS, CAN, GER, NZL target using this syntax can have a significant perfermance impact an the system if tea many targets are tasked this way. NUT E: realmQ tasking shauld he used in preference ta Aliases: inane} Cnnteat Type: Hash Eample: If an email address If a caakie yalue email_addr'ess Description: Autamatica]ly attempts ta determine realm far the given email address and then creates permutaticms tc- task in the main scanner engine far the given target. Given the number nf permutatic-ns far a single target using this syntax can have a significant perfermance impact an the system if tee many targets are tasked this way. NUT E: realmf) tasking shnuld he used in preference ta Aliases: inane} IEIIJrnteat Type: Hash Eample: raw_email Descriptiun: Tasks the given email address with nu pennutatipns in the raw_email cement. The raw_email cantest is fed email addresses the email address extractar which scans all traffic lac-king far and then uses heuristics ta determine if the is part af an email address. Hate that the nutput is alsn scanned far email addresses, as is the fully nc-rmalized applicatian?layer pmcessed cantent. Aliases: Ennteat Type: Hash Eample: email_cc Descriptiun: [Sift?{EL} The cauntry cade assaciated with an email address. Far example if the email address is the cauntry cede is Aliases: TD USA, AUS, CAN, GER, NZL

TD USA, AUS, CAN, GER, NZL Ennteat Type: Hash Eample: ur categury Descriptiun: The CADENCE categary that has evaluated true an this sessian. Hate that the CADENCE categc-ry must have a valid FIST entry far this cantest ta fire. Aliases: cat Ennteat Type: Hash Eample: categaryCEE-LH?) categnry_prinrity tan Description: [Sift?{EL} The priurity bf the CADENCE categury that generated a hit. Hate that the CADENCE categary must have a valid FIST entry far this cantest ta fire. Aliases: cat_pri Ennteat Type: Hash Eample: categary_pric- rity[1) Descriptiun: Luuhs up all phune numbers fuuncl in signature blacks and uther content as as phune numbers found in The TND field will accept traditiunal and 1wildcarcls. will match any number and is permissible at the beginning and 1will match any number af cligits at the beginning af the number. Aliases: phune mubile cell phu ne_number msisdn Cnnteat Type: tnd_lc:uhup TD USA, AUS, CAN, GER, NZL

SECRETHCCIMINTHREL TCI USA, AUS, CAN, GER, NZL Eample: tnd[?5551234?) irnei Deseriptinn: All IMEIs fannd in netwerk pretaeals er HTTP headers [as seen in many cellular preyiders). Aliases: snanea Contest Type: tnd_1aakup Eanlple: inlei[? 12345 12345) inlsi Deseriptinn: All IMSIs fennel in netwerk pretaeals er HTTP headers [as seen in many cellular prayiders). Aliases: snanea Canteat Type: tnd_1aakup Eample: inlsi[? 12345) TU USA, AUS, CAN, GER, NZL

TD USA, AUS, CAN, GER, NZL Of?ce Deeuments deeuntenLtitle Description: The title ef the effiee deennient. [Srftiee deeunients include (but are net ]in1ited te) Miereseh Dime, [tip-en C?dfiee, [Seegie Bees and Spreadsheets. Aliases: dee_title Sean Eanlple: dee nn1ent_title[? situatien repert') deeunteanuhjeet Description: The subject ef the effiee deennient. [Zrh?iee deeunients include (but are net Jiniited te) Miereseft [Clrl?i?iee, Open Dhiee, [Seegle Bees and Spreadsheets. Aliases: dee_suhjeet Centest Type: Sean Eanlple: dee nn1ent_s uhjeet[?1ate st figures deeuntenLauther Deseriptien: The anther ef the effiee foiee inelede (but are net ]in1ited te) h?ereseh (Suitcase, Uttiee, Eeegle Bees and Spreadsheets. Aliases: dee_auther Centeat Type: Sean Eanlple: deennient_a etherf?hadguy') deeuntenLei-g Deseriptien: The authering erganiaatien ef the effiee deennient TD USA, AUS, CAN, GER, NZL

TD USA, AUS, CAN, GER, NZL Office decuments include (but are net limited tan Micmsc-ft Office, Open Office, Oeegle Decs and Spreadsheets. Aliases: dec_drg Ennteat Type: Scan Eample: ducumenLhash Descriptiun: The It.?an sum the nffice dncumentfimages frem within the decument. Office decuments include (but are net limited tan Micmsc-ft Office, Open Office, [Sc-c-gle Decs and Spreadsheets. Aliases: dec_hash Ennteat Type: Hash Eample: decument_ha sh[?cfd2cE??a42hd?El IdeSeS?f?acElhcf? ducument_language Descriptiun: The language df the Office decument. The language can he determined the decument pmperties and er statistcal analysis ef the underlying test. All languages are nc-rmalized th twc- letter language cudes. Office dncuments include (but are net limited ta) Micmsc-ft Office, Open Office, Decs and Spreadsheets. Aliases: dec_langua ge Cnnteat Type: Hash Eample: Descriptiun: The nc-rmalized teth df the Office decument. Office dncuments include (but are net limited ta) Micmsc-ft Office, Open Office, Oeegle Decs and Spreadsheets. Aliases: dec_hcrd TD USA, AUS, CAN, GER, NZL

TD USA, AUS, CAN, GER, NZL Sean tn? and ?hujld? and er C?mmunicatinns Cantent Deseriptinn: The test at the foiee dnenntent. foiee dneuntents include (but are net hntited tn) foiee, Open [Ethics Enngle Bees and Spreadsheets. Aliases: dne_hed Enntest Type: Sean tnI and ?hujlel' and (?he-nth? nr tlneuntenLentniLhn-jy Deseriptinn: The test nf s]l nffiee dnenntent and email hndies. Aliases: Centest Type: Sean Missed tn and d?ClJtIl-E?Lh?dy. tn? and ?build? and er Deseriptinn: The test nf s]l nffiee dnenntent, email, and chat hndies. Aliases: Enntest Type: Sean Alia sed tn ehst_hndy and d?ClltIlE?Lh?dy. eemmunieetienjedyfhew te? and ?hujld? and [?hemh? er emaiLh ntly TD USA, AUS, CAN, GER, NZL

TD USA, AUS, CAN, GER, NZL Description: The test at? all email lac-dies. Aliases: email_hdd Type: Scan Eample: ten? and ?huild' and [?hdmh' pr ?weapan')) chat_h tidy Descriptinn: The test pf all chat hddies. Aliases: Cantest Type: Scan Eample: to? and ?build? and [?hdmh? cur calendar_hpdy Descriptinn: The nc-rmaliaed test pf all calendars. An example is Gadgle Calander. Aliases: Cantest Type: Scan Eample: cale nda 1wedding?) archiyejiles Descriptinn: Matches a list at files within an archive. Far example is a ZIP file is transmitted, all names pf files within are passed th this canteirt. Aliases: campressedjilenames Cantest Type: Scan Eample: cur ?yims.dcrc?) http_p nst_hndy Descriptinn: TD USA, AUS, CAN, GER, NZL

TD USA, AUS, CAN, GER, NZL The nernislised test HTTP urleneeded Aliases: inane} Centest Type: Sean Eanlple: n= send: and ?had guy@ yahee language Deseriptinn: The language cede fer either deeuntents er 1weh activity. Aliases: inane: Cnntest Type: Hash Alia sed te dee_langua ge and http_language. Eanlple: language[?ar?) title Deseriptinn: The title at either effiee deennients er HTML pages. Aliases: inane} Centest Type: Sean Alia sed te dee_title and html_title. Eanlple: title[?hen1h melting?) Fraternal Metadata Deseriptinn: The textual fern: ef the IP nest Aliases: ?nenee Centest Type: internal Eanlple: UDP ICMP TD USA, AUS, CAN, GER, NZL

TD USA, AUS, CAN, GER, NZL ip_next_pratn=enl Deseriptinn: The textual farm at the IP next prataeal. Aliases: snanea Cnntext Type: internal Eanlple: tn_ip in Description: The sauree IP address at the sessian. Aliases: frantip Cnntext Type: Sean Eanlple: Deseriptinn: The destinatian IP address at the sessian. Aliases: teip IEIIJrntext Type: Sean Eample: ta_ip[? Deseriptinn: The sauree er destinatien IP address at the sessian. Aliases: snanea Cnntext Type: Sean Eanlple: frnm_p art Deseriptinn: The sauree TCP ar UDP part number. TD USA, AUS, CAN, GER, NZL

TD USA, AUS, CAN, GER, NZL Aliases: Centext Type: inte mal Eample: frdm_pdrt(2 2) tn_pert Deseriptien: The destinatidn TCP dr UDP part number. Aliases: tdp-Drt Context Type: inte [n31 Eample: tap-an2) pert Deseriptien: The Eduree dr destinatidn TCP dr UDP part number. Aliases: ?ndnee Context Type: inte [n31 Eample: e?nt?) ip_suhnet Deseriptien: IP suhnet in CIDR ndtatidn. Aliases: Sean Eample: mae_adtlress Deseriptien: The MAC address at the target device. TD USA, AUS, CAN, GER, NZL

TD USA, AUS, CAN, GER, NZL Aliases: mac Scan Eample: ts Misc checkpoint appid Descriptinn: A system defined checkpoint ta ensure gnarenteed arder?af?eitecntian. This is typically used when a fa?awcn?ac?an must he perfarmed after same prede?ned pmcessing step, far example access ta pre?parsed HTTP header infarmatian is anly available after the internal http_parser plngin has executed. Aliases: snanea Cantest Type: Hash Eample: Descriptinn: The applicatian ID af the sessian. NUT E: ta prevent infinite recursian anly ane leyel af indirectian is permitted when including appidQ as part af anather haplean espressian. Aliases: snanea Cantest Type: inte mal Eample: appid [fmail.*f) preappid Descriptinn: The pre?applicatian ID of the sessian. A pre?applicatian is a haalean espressian far an applicatian that fired an a sessian, but did nat necessarily win (based an priarity). Far example a Yahaa wehmail sessian will pmhahly first be identi?ed as HTTP, then Yahaa, and then finally we see a string indicating that the traffic is mail. As the decisian was being made each af the intermediate appids can generate a pre?appid event. TD USA, AUS, CAN, GER, NZL

SECRETHCCIMINTHREL TCI USA, AUS, CAN, GER, NZL NUT E: ta prevent infinite reenrsinn nnly nne level of indirectian is permitted when inelnding preappidf) as part ef anather hanlean expressinn. Aliases: snanea Cnnteat Type: internal Eanrple: prea fingerprint tnpie Description: A fingerprint that fired an a sessinn. NUT E: ta prevent infinite reenrsinn dnly dne level nf indirectian is permitted when including fingerprintf) as part df anather haelean espressian. Aliases: Cnntest Type: internal Earnple: Deseriptinn: A tapie that fired an a sessian hased df a previaus tapie definitian. NUT E: ta prevent infinite reenrsian dnly dne level nf indirectian is permitted vvhen inelnding tnpieQ as part nf anather her-lean espressian. Aliases: Cnnteat Type: internal Eanlple: tapie[?vvn1dfpalristan' and nrd?thin. USA, AUS, CAN, GER, NZL