anchor.diff:  +
   image::images/example_example1.png[Aho-Corasick Automata Example]
   +
  -Passing input such `she saw his world as he saw hers...` through would match the following. The numeric values are the offsets of the end of the patterns in the input.
  +Passing input such as `she saw his world as he saw hers...` through would match the following. The numeric values are the offsets of the end of the patterns in the input.
   +
   .Example Execution
   ----
  
positive.code: 
  ==== Rule Based Inspection
  
  IronBee provides a generic framework for scheduling and executing operators and performing actions via rules - a rule engine. The state diagram indicates where the rule engine executes rules.  These points are called ``phases''. While most rule systems use the rule engine, this is not required. Note that the term ``Rules'' is used loosely here as IronBee does not limit what functionality a rule can provide nor syntax for defining rules. A rule is defined generically as some meta data, an operation to perform (typically on some data, such as a regular expression) and one or more actions to execute based on the results of this operation. A number of different rule systems and syntax exist; all with different goals. These different systems are encapsulated into modules that can be loaded into IronBee, which means that you only need to load the functionality that you need. To perform inspection, however, you need to choose what techniques to use (e.g., what modules to load).
  
  ===== Configuration Based Rules
  
  
negative.code: 
  XRules::
  
  XRules (eXtended Rules), loaded via the _xrules_ module, allow writing simple rules to perform common tasks. XRules do not use the rule execution engine, but instead use normal module state hooks. By doing this they can provide a simple syntax by making assumptions based on the type of rule. For example, you do not have to specify a phase as that phase is inherit in the type of rule. Additionally XRules are designed for fast execution so that you do not have to think about performance. XRules accomplish this by combining together multiple rules of the same type into a larger, but more efficient operation. XRules are typically used to perform firewall like operations, allow dynamic configuration to control inspection, and perform exceptions for other rule systems.
  +
  A good example of all of this is IP based blocking rules. These are done via the `XRuleIPv4` and `XRuleIPv6` directives. No phase is needed as these rules will run as early as possible. And to be efficient, all IP based rules are combined together into a single IP set matching algorithm, so no matter how many IP based rules you create, they will all be combined into a single matching operation.
  +
  