Address-group arrays with AND instead of OR?

It’s just a list, so if there is a check for HOME_NET as long as one of the IPs is one of those listed the signature would match (given the case that all the rest of the signature matches as well).

As you can see with EXTERNAL_NET negation is working. So you could try `EXT_NOT_YAHOO:“[$EXTERNAL_NET,!$YAHOO]”.