Creating Enforcement Action Dynamic Value Statements

Use Dynamic Value statements (also referred to as "statements") to add dynamic values to fields in Enforcement Actions using values from the assets themselves.

Two types of statements are available for use:

• "All" statements - These statements read over all the assets in the asset pool one by one and populate the values fetched from the asset itself into Action form fields.
• Switch/Case statements - These statements check an asset field (declared in the switch) for multiple criteria (each declared by a case) and use those values to populate the Action fields.

Some examples for the use of statements:

• You can create an Enforcement Set with its main action to create a ticket/incident. In the statement, you can determine how to fill the description or summary fields of the ticket/incident with information from the asset.
• You can create an Enforcement Set with its main action to Add Tag to Assets. In the statement, you can set criteria to assign different tag values to different assets.
• You can create an Enforcement Set with its main action to Add Custom Data to Assets. In the statement, you can create a calculated custom field based on values from several fields, create a custom field to assign a numerical rank to vulnerabilities, and much more.

The Configure Dynamic Values toggle appears in every Enforcement Action. Any user with either Add Enforcement or Edit Enforcement permission, or both, can create statements.

You can resize the Define the statement text box by dragging the handle at the lower-right corner.

When you create an enforcement set (in the Create Enforcement Set dialog), the first step is to select a Main Action to add to the Enforcement Set. The relevant enforcement action dialog is displayed, with required fields. Make sure to fill in all of the required fields with values. For example, when you create an Enforcement Set with Main Action - Add Custom Data to Assets, fill in the Field name and Field value action fields. The field value replaces an empty result if during an Enforcement Set run, the Dynamic Value statement gives an empty result (for example, if the adapter field used is empty for an asset) or the asset does not meet any of the criteria defined in the statement. This is relevant for all statements.

To create a statement

1. Configure the Enforcement Action.

2. Toggle on Configure Dynamic Values.

3. Determine the type of statement to use:
   * "All" statements
   * Switch/Case statements

4. Construct a statement in the Define the statement text box including action form fields, adapter fields, functions, and operators, using either of the following methods:

   • The Dynamic Value Statement Wizard
   • The Syntax Helper with Autocomplete feature

5. Click Validate. Axonius checks that the statement syntax is correct. It does not validate field types or values.

   • If the syntax is correct, the message 'Statement was validated successfully' is displayed in green under the text box.
   • If there is a syntax error, a detailed error message is displayed in red under the text box. Fix the error, and repeat this step.

When the Enforcement Set is run, the statement is used.

Syntax Tips

• Static string values must be written within quotation marks " ". For example: "@gmail.com". They should not be pasted from other systems.
• Make sure that the quotation marks are straight and not curly, as curly ones are not supported.
• Functions and operators must be followed by (values) in parentheses.
• A field name following "switch" does not require square brackets.

Example

Enforcement Action used: Axonius - Add Tag to Assets
In the following Dynamic Value statement used to tag users, all users with their user country field (user.specific_data.data.user_country) having the value "United States" are tagged with a "US" tag. Users with no entry for their user country or a country other than "United States" are tagged with the Tag default value configured in Tag names (in the Enforcement Action configuration dialog) - in this case, "fallback".

switch user.specific_data.data.user_country
case field_equal ("United States") then form.tag_name set_value "US"