- name: "Drop syn scan"
    when: "beforeFinalSave"
    expression: "packets.src == 1 && packets.dst == 0 && tcpflags.syn == 1"
    ops:
      _dontSaveSPI: 1