---
- rule: some rule
  desc: some desc
  condition: evt.type=open
  output: some output
  priority: INFO
---
- rule: some rule
  desc: some desc
  condition: bar
  output: some output
  priority: INFO
  append: true