Ingestion Rule Statement Reference

This page describes how to construct an ingestion rule statement. Each statement is made up of a primary statement and an optional post action. For the full list of operators you can use in a primary statement, see Ingestion Rules Operators. For post actions, see Ingestion Rules Post Actions.

Primary Statement

An entity is considered for ingestion if the primary statement is true. A primary statement can be built in one of two ways (use the relevant asset name in the first position):

• {asset type}.{flattened key path of the entity} {operator} {rule values}
• {asset type} {operator} {rule values}

Complex Primary Statements

Primary statements support complex conditions by combining multiple sub-rules using AND, OR, and parentheses. This enables creating detailed asset ingestion criteria. For example: ((Value > 50 AND Confidence = HIGH) OR (Value > 90 AND Confidence = LOW))

• Each sub-rule within a primary statement is evaluated independently for an asset.
  • OR: If any sub-rule is TRUE, the statement is TRUE. Evaluation stops when a TRUE sub-rule is found.
  • AND: All sub-rules must be TRUE for the statement to be TRUE.
• If multiple primary statements exist, each is evaluated independently.
  • OR: If any primary statement is TRUE, the asset is ingested. Evaluation stops when a TRUE primary statement is found.
  • AND: All primary statements must be TRUE for the asset to be ingested.

Examples

{entity}.{key} {operator} {value} or/and {entity} {operator} {value}

({entity}.{key} {operator} {value} or/and {entity} {operator} {value}) and/or {entity}.{key} {operator} {value}

({entity}.{key} {operator} {value} or/and {entity} {operator} {value}) and/or ({entity}.{key} {operator} {value} or/and {entity} {operator} {value})

Post Action

Post actions are optional actions performed on the entity before it is ingested into Axonius. Common use cases include filtering out poor data or dropping PII.

The syntax is:

{primary statement} then {action} {post rule values}

See Ingestion Rules Post Actions for all available post action operators.

Ingestion Rule Components

Entities

Defines which entity (asset type) this rule will be applied to: device, user, ticket, certificate, and so on.

Flattened Key Path

The flattened key path of the entity is the name of the key path as it appears in the Axonius database.

Example: "I want to only ingest devices from the cmdb_ci_server table in ServiceNow."

You can translate this into a Query Wizard statement:

This statement is automatically translated into an Axonius statement in the Devices search bar:

("adapters_data.service_now_adapter.class_name" == "cmdb_ci_server")

Because ingestion rules are already applied at the adapter level, you can ignore the adapters_data.service_now_adapter. prefix. That leaves the flattened key path as simply class_name.

When working with complex objects such as network interface IP addresses, copy the complete complex object path, for example network_interfaces.ips.

Related Pages

• Setting Adapter Ingestion Rules — Overview and required permissions
• Ingestion Rules Operators — All supported filter operators
• Ingestion Rules Post Actions — Modify or drop fields before ingestion
• Ingestion Rules Examples — Real-world configuration examples