Ingestion Rules Operators
This page lists all operators available for use in ingestion rule primary statements.
This page lists all operators available for use in ingestion rule primary statements. For syntax guidance, see Ingestion Rule Statement Reference. For post action operators that modify fields after a condition is matched, see Ingestion Rules Post Actions.
Operators Summary
| Operator | Description |
|---|---|
== / != | Equal / Not Equal |
< / > | Less Than / Greater Than (dates and numbers) |
>= / <= | Greater Than or Equal / Less Than or Equal (numbers only) |
in / not_in | Value in / not in a list |
in_net / not_in_net | IP address in / not in a network |
starts_with / not_starts_with | Starts with / does not start with a pattern |
ends_with / not_ends_with | Ends with / does not end with a pattern |
key_exists / key_not_exists | Field exists / does not exist |
field_equal / field_not_equal | Field value equals / does not equal another field |
field_starts_with / field_not_starts_with | Field value starts with / does not start with another field's value |
contains / not_contains | Contains / does not contain a value (case-insensitive) |
match_regex / not_match_regex | Matches / does not match a regex pattern |
Equal / Not Equal (== | !=)
== | !=)Checks whether the value from the entity is equal or not equal to the rule values.
Note
The condition
asset.key != "value"only returns assets where the fieldkeyexists and is not equal to"value". To also include assets wherekeyis missing or empty, use:(asset.key != "value" or asset key_not_exists ["key"]). See Key Exists / Key Not Exists below.
device.class_name == "cmdb_ci_computer"(device.class_name != "cmdb_ci_computer" or device key_not_exists ["class_name"])(device key_not_exists ["vlan"] or device.vlan != "888") and (device key_not_exists ["ssid"] or device.ssid != "ALLETEGUEST")Do not use equals with lists, as they will be converted to strings:
device.ad_dc_source != ["10.10.11.0/24"] (checks if value is equal to str(list))Dates — Less Than / Greater Than (< | >)
< | >)Checks whether the value from the entity is less than or greater than the date specified in the rule value.
Supported Syntax
date(YYYY-MM-DD)date(now-nd)date(now+nd)
Where n is the number of days (d).
Note
Dates do not support greater than or equal to (
>=) or less than or equal to (<=) operators.
Examples
user.termination_date > date(2024-10-31)Ingest users whose termination date is after October 31st, 2024.
user.last_logon > date(now-10d)Ingest all users with last_logon later than 10 days ago (that is, within the last 10 days).
user.terminated_date > date(now+365d) then skip_field ["terminated_date"]Ingest all users with terminated_date later than 365 days in the future, but skip the ingestion of the terminated_date field itself.
Numbers
Checks whether the value from the entity is greater than or less than the value provided. Supports <, >, >=, and <=.
device.confidence_level < 65 then skip_field ["os.type", "os.distribution", "os.type_distribution", "os.os_str"]If the confidence level for devices is below 65, do not ingest OS level information.
Note
This rule excludes all devices with a confidence level below
>=65. Use the following rule in conjunction with the OR operator to ensure that all devices are still ingested from that adapter:device key_exists ["id"]
device.policies_compliance_count >= 1Ingests all devices with at least one compliance policy present.
Value In / Value Not In (in | not_in)
in | not_in)Checks whether the value from the entity is in or not in the list of rule values.
device.ad_name in ["EC2AMAZ-71GIQSBBB", "EC2AMAZ-71GIQSORRRR"]device.ad_name not_in ["EC2AMAZ-71GIQSBBB", "EC2AMAZ-71GIQSORRRR", "EC2AMAZ-71GIQSO"]IP Address In or Not In (in_net | not_in_net)
in_net | not_in_net)Checks whether the IP address or network value from the entity is in or not in the rule's IP network. You can check if an IP or subnet is within a CIDR range. Applicable to both IPv4 and IPv6.
device.network_interfaces.ips in_net ["10.10.11.0/24"]device.network_interfaces.ips not_in_net ["192.168.11.0/24"]Starts With / Does Not Start With (starts_with | not_starts_with)
starts_with | not_starts_with)Checks whether the value from the entity starts with or does not start with a required pattern.
device.ad_usn_changed starts_with ["91"]device.ad_name not_starts_with ["EC2", "S3"]Ends With / Does Not End With (ends_with | not_ends_with)
ends_with | not_ends_with)Checks whether the value from the entity ends with or does not end with a required pattern.
user.mail ends_with ["@gmail.com", "@yahoo.com"]user.username not_ends_with ["_test"]Key Exists / Key Not Exists (key_exists | key_not_exists)
key_exists | key_not_exists)Checks whether all supplied key values exist or do not exist.
device key_exists ["network_interfaces.ip", "ad_name"]user key_not_exists ["database"]Field Equal / Field Not Equal (field_equal | field_not_equal)
field_equal | field_not_equal)Checks whether the value of one field in an entity is equal or not equal to the value of another field in that entity.
device.hostname field_not_equal ["ad_name"]Only ingest devices where the hostname field is not equal to the value in the ad_name field.
Field Starts With (field_starts_with)
field_starts_with)Checks whether the value of one field in an entity starts with the value of another field in that entity.
device.ad_sAMAccountName field_starts_with ["ad_name"]Ingest the device only if its sAMAccountName begins with the value in ad_name.
Field Not Starts With (field_not_starts_with)
field_not_starts_with)Checks whether the value of one field in an entity does not start with the value of another field in that entity.
device.hostname field_not_starts_with ["name"] then skip_field ["hostname", "fqdn"]The device is only ingested if its hostname does not start with its asset name. Ingested devices also have their hostname and fqdn fields dropped.
Note
Consider adding
device key_exists ["id"]to this rule (OR'd together) if you still want to ingest devices where their hostname begins with their asset name.
Contains / Not Contains (contains | not_contains)
contains | not_contains)Checks whether the value from the entity does or does not contain any of the rule values. This operator is case-insensitive.
device.ad_sAMAccountName contains ["axonius"]device.ad_sAMAccountName not_contains ["check1", "check2"]Match Regex / Not Match Regex (match_regex | not_match_regex)
match_regex | not_match_regex)Checks whether the provided regex string pattern matches or does not match the device field value.
device.name match_regex ["WIN.+test"]Related Pages
- Ingestion Rule Statement Reference — Primary statement syntax and components
- Ingestion Rules Post Actions — Modify or drop fields after a match
- Ingestion Rules Examples — Real-world configuration examples
Updated 11 days ago