Yes this is the right section. In 2.0 it is named “detect” not “scan_function”.
I would first check what is the content of the OID “.1.3.6.1.2.1.1.2.0” and then i would write a “contains” instead of the used “exists”. Exists should also work but your check for the OID of a table then the exists should end with a “.*”.
detect = exists(".1.3.6.1.4.1.12356.101.4.9.2.1.*"),
Alternative like this here.
detect = contains(".1.3.6.1.2.1.1.2.0", ".1.3.6.1.4.1......."),
or
detect = startswith(".1.3.6.1.2.1.1.2.0", ".1.3.6.1.4.1........"),