- 15 Oct 2023
- 4 Minutes to read
Switch/Case Statement Syntax
- Updated on 15 Oct 2023
- 4 Minutes to read
Switch/case statements allow you to create complex Dynamic Value statements (also referred to as 'statements'). They check an asset field (declared in the switch) for multiple criteria (each declared by a case) and use those values to populate the Action fields.
Only assets matching the filter are affected using the matching value for the Action field.
The basic syntax of Switch/case statements for the various asset types is presented in the following table, followed by a description of the statement elements.
|Asset Type||Basic Syntax|
- switch - Configure the field on which to apply the filter defined by the case statements that follow.
.adapters_data.adaptername.fieldname]- The source field of the Adapter (as displayed in the query bar). The asset-type prefix (for example: device, user, vulnerability, or software) must reflect the type of asset query. This value must be enclosed in square brackets. For example, [device.adapter_data.adaptername.fieldname]. Use Syntax Helper or the Dynamic Value Statement Wizard to get the correct field name.Note:
Adapter field names must be written in square brackets in the following format. For example:
- [entity.<value pasted from query language>]
- case - Define the filter criteria using one of the operators described in the following table. Autocomplete and the Dynamic Value Statement Wizard present a dropdown with a choice of operators. The examples above check if the field name starts_with " ".
|starts_with (" ")||The field name starts with the indicated text within the " ".|
|ends_with (" ")||The field name ends with the indicated text within the " ".|
|not_starts_with (" ")||The field name does not start with the indicated text within the " ".|
|not_ends_with (" ")||The field name does not end with the indicated text within the " ".|
|contains (" ")||The field name includes the indicated text within the " ".|
|field_equal (" ")||The field value is identical to the text within the " ".|
|field_not_equal (" ")||The field value is not identical to the text within the " ".|
|gt(n)||The numeric field value is greater than the number or numeric field value n.|
|lt(n)||The numeric field value is less than the number or numeric field value n.|
|count(n)||Counts and matches the n items in a list.|
|in(“string1”, "string2", ..., "stringN")||The string field value is equivalent to one of the strings in the parentheses.|
|not_in(“string1”, "string2", ..., "stringN")||The string field value is not equivalent to any of the strings in the parentheses.|
|field_exists||Tests whether the field exists.|
|sum([adapter.field])||Returns the sum of all the number values in the list. The field type of adapter.field is a list (array) of numbers.|
- then - then apply this value from the Adapter only to the assets whose field name starts with the value in starts_with.
- form_fieldname - The field name in the Action. Use Autocomplete or the Dynamic Value Statement Wizard to choose the action field name or Use the Syntax Helper to find the correct action field name.
- set_value - Tells the Action to set the value of form_fieldname to the value of the string or in the case that there is more than one string (item1 or item2 ... or itemN), to the first string that has a value.
More operators and functions are available than are used in these examples. See Enforcement Action Statement Syntax Table for a complete list of available statement elements and their syntax.
Switch/Case Statement Examples
The following examples illustrate some ways Switch/Case statements can be used.
Example - Split the assets that match the query according to the value in hostname, and use that value to determine the action form email recipient.
- If the hostname starts with "a", then set the email recipient to [email protected]
- If the hostname starts with "b", then set the email recipient to [email protected]
switch device.adapters_data.active_directory_adapter.hostname case starts_with ("a") then form.emailList set_value "[email protected]" case starts_with ("b") then form.emailList set_value "[email protected]"
Example - Split the assets that match the query according to the value of fieldA, and use that value to determine the action form tag_name.
- If fieldA starts with "a", then set the tag name to "x".
- If fieldB starts with "b", then set the tag name to "y".
- If fieldA starts with "c", then set the tag name to "z".
switch user.adapters_fieldA case starts_with ("a") then form.tag_name set_value "x" case starts_with ("b") then form.tag_name set_value "y" case starts_with ("c") then form.tag_name set_value "z"
Example - For all device adapters with qualys agent vulnerability score field value greater than 9, set the value of the Action form field number to 100.
switch device.adapters_data.qualys_scans_adapter.qualys_agent_vulns.score case gt(9) then form.field_number set_value 100
For more information about working with Enforcement Sets see the following:
Enforcement Center Overview
Using the Enforcement Center Page
Managing Enforcement Sets
Creating Enforcement Sets
Testing an Enforcement Set
Creating Enforcement Action Dynamic Value Statements
Scheduling Enforcement Set Runs
Running Enforcement Sets
Viewing Enforcement Set Run History
Terminating an Enforcement Set Run
Duplicating Enforcement Sets
Editing and Deleting Enforcement Sets