Switch/Case Statement Syntax

Switch/case statements allow you to create complex Dynamic Value statements (also referred to as 'statements'). They check an asset field (declared in the switch) for multiple criteria (each declared by a case) and use those values to populate the Action fields.
Only assets matching the filter are affected using the matching value for the Action field.

The basic syntax of Switch/case statements for the various asset types is presented in the following table, followed by a description of the statement elements.

Where

• switch - Configure the field on which to apply the filter defined by the case statements that follow.
• [.adapters_data.adaptername.fieldname] - The source field of the Adapter (as displayed in the query bar). The asset-type prefix (for example: device, user, vulnerability, or software) must reflect the type of asset query. This value must be enclosed in square brackets. For example, [device.adapter_data.adaptername.fieldname]. Use Syntax Helper or the Dynamic Value Statement Wizard to get the correct field name.
  Note:

  Adapter field names must be written in square brackets in the following format. For example:

  • [device.adapters_data.active_directory_adapter.hostname]
  • [user.adapters_data.active_directory_adapter.username]
  • [vulnerability.adapters_data.active_directory_adapter.username]
  • [software.adapters_data.active_directory_adapter.username]
  • [entity.<value pasted from query language>]
• case - Define the filter criteria using one of the operators described in the following table. Autocomplete and the Dynamic Value Statement Wizard present a dropdown with a choice of operators. The examples above check if the field name starts_with " ".

• then - then apply this value from the Adapter only to the assets whose field name starts with the value in starts_with.
• form_fieldname - The field name in the Action. Use Autocomplete or the Dynamic Value Statement Wizard to choose the action field name or Use the Syntax Helper to find the correct action field name.
• set_value - Tells the Action to set the value of form_fieldname to the value of the string or in the case that there is more than one string (item1 or item2 ... or itemN), to the first string that has a value.

More operators and functions are available than are used in these examples. See Enforcement Action Statement Syntax Table for a complete list of available statement elements and their syntax.

Switch/Case Statement Examples

The following examples illustrate some ways Switch/Case statements can be used.

• Example - Split the assets that match the query according to the value in hostname, and use that value to determine the action form email recipient.

  • If the hostname starts with "a", then set the email recipient to [email protected]
  • If the hostname starts with "b", then set the email recipient to [email protected]

  switch device.adapters_data.active_directory_adapter.hostname
  case starts_with ("a") then form.emailList set_value "[email protected]"
  case starts_with ("b") then form.emailList set_value "[email protected]"
  

• Example - Split the assets that match the query according to the value of fieldA, and use that value to determine the action form tag_name.

  • If fieldA starts with "a", then set the tag name to "x".
  • If fieldB starts with "b", then set the tag name to "y".
  • If fieldA starts with "c", then set the tag name to "z".

  switch user.adapters_fieldA 
  case starts_with ("a") then form.tag_name set_value "x" 
  case starts_with ("b") then form.tag_name set_value "y"
  case starts_with ("c") then form.tag_name set_value "z"
  

• Example - For all device adapters with qualys agent vulnerability score field value greater than 9, set the value of the Action form field number to 100.

  switch device.adapters_data.qualys_scans_adapter.qualys_agent_vulns.score 
  case gt(9) then form.field_number set_value 100