···116116 if _, ok := c.Profiles[rule.Profile]; !ok {
117117 return fmt.Errorf("detection rule %d: references unknown profile %s", i, rule.Profile)
118118 }
119119- if rule.Match.SystemManufacturer == "" && rule.Match.ProcessorManufacturer == "" {
120120- return fmt.Errorf("detection rule %d: at least one match criterion required", i)
119119+120120+ // Must have either match or match_either
121121+ if rule.Match == nil && len(rule.MatchEither) == 0 {
122122+ return fmt.Errorf("detection rule %d: must have match or match_either", i)
123123+ }
124124+125125+ // Validate match criteria
126126+ if rule.Match != nil {
127127+ if rule.Match.SystemManufacturer == "" && rule.Match.ProcessorManufacturer == "" && rule.Match.Arch == "" {
128128+ return fmt.Errorf("detection rule %d: at least one match criterion required", i)
129129+ }
130130+ }
131131+132132+ // Validate match_either criteria
133133+ for j, m := range rule.MatchEither {
134134+ if m.SystemManufacturer == "" && m.ProcessorManufacturer == "" && m.Arch == "" {
135135+ return fmt.Errorf("detection rule %d, match_either %d: at least one match criterion required", i, j)
136136+ }
121137 }
122138 }
123139 }