Alarms can match multiple AO Profiles. As mentioned earlier the ordering can be change (move up move down) and order set by right clicking on profiles. In some cases, depending on the "Action type" of profile, you can set skip further check option on advanced tab, breaking further profile checks. This is only enabled for some Profile action types.
Pre-proc rules: When I test it seems it will only match first instance hit therefore order and filtering would seem very important. Also order of pre-procs cannot be manipulated (via the gui anyway).
My Test - Created 2 pre-proc rules:
- pre-proc-test1 & pre-proc-test2 each running custom script pre-proc 1 & 2
- Scripts manip event.message to "hit pre-proc 1" "hit pre-proc 2" respectivly
Both pre-proc rulels looking for sid i made up 3.9.9.9.
Sent alarm with sid 3.9.9.9 with both rules enabled and only receive "hit pre-proc 1". deleted alarm, deactivated the pre-proc-test1 (leaving only pre-proc-test2 active) and message modified to "hit pre-proc 2"