The figure shows a tree like structure with the text OR appearing as the root node. This root node has two child nodes, called AND and AND.

The first AND node in turn has the following child nodes:

• Threat Severity [=Moderate]

• Protected Database [= sales_db]

The second AND node has the following child nodes:

• Threat Severity [=Minor]

• DB Client IP Address [=192.0.2.1]

�