Switch/Case Statement Syntax
  • 04 Aug 2024
  • 5 Minutes to read
  • Dark
    Light
  • PDF

Switch/Case Statement Syntax

  • Dark
    Light
  • PDF

Article summary

switch/case statements allow you to create complex Dynamic Value statements (also referred to as 'statements'). They check an asset field (declared in the switch) for multiple criteria (each declared by a case) and use those values to populate the Action fields.
Only assets matching the filter are affected using the matching value for the Action field.

IMPORTANT
All values, operators, and syntax elements in statements are lower case and case sensitive.

The basic syntax of switch/case statements for the various asset types is presented in the following table, followed by a description of the statement elements.

Asset TypeBasic Syntax
Deviceswitch device.adapters_data.adaptername.fieldname case starts_with ("a") then form.form_field set_value "aaa" case starts_with ("b") then form.form_field set_value "bbb" case starts_with ("c") then form.form_field set_value "ccc"
Userswitch user.adapters_data.adaptername.fieldname case starts_with ("a") then form.form_field set_value "aaa" case starts_with ("b") then form.form_field set_value "bbb" case starts_with ("c") then form.form_field set_value "ccc"
Vulnerabilityswitch vulnerability.adapters_data.adaptername.fieldname case starts_with ("a") then form.form_field set_value "aaa" case starts_with ("b") then form.form_field set_value "bbb" case starts_with ("c") then form.form_field set_value "ccc"
Softwareswitch software.adapters_data.adaptername.fieldname case starts_with ("a") then form.form_field set_value "aaa" case starts_with ("b") then form.form_field set_value "bbb" case starts_with ("c") then form.form_field set_value "ccc"

Where

  • switch - Configure the field on which to apply the filter defined by the case statements that follow.
  • [.adapters_data.adaptername.fieldname] - The source field of the Adapter (as displayed in the query bar). The asset-type prefix (for example: device, user, vulnerability, or software) must reflect the type of asset query. This value must be enclosed in square brackets. For example, [device.adapter_data.adaptername.fieldname]. Use Syntax Helper or the Dynamic Value Statement Wizard to get the correct field name.
    Note:

    Adapter field names must be written in square brackets in the following format. For example:

    • [device.adapters_data.active_directory_adapter.hostname]
    • [user.adapters_data.active_directory_adapter.username]
    • [vulnerability.adapters_data.active_directory_adapter.username]
    • [software.adapters_data.active_directory_adapter.username]
    • [entity.<value pasted from query language>]
  • case - Define the filter criteria using one of the operators described in the following table. Autocomplete and the Dynamic Value Statement Wizard present a dropdown with a choice of operators. The examples above check if the field name starts_with " ".
headerheader
starts_with (" ")The field name starts with the indicated text within the " ".
ends_with (" ")The field name ends with the indicated text within the " ".
not_starts_with (" ")The field name does not start with the indicated text within the " ".
not_ends_with (" ")The field name does not end with the indicated text within the " ".
contains (" ")The field name includes the indicated text within the " ".
field_equal (" ")The field value is identical to the text within the " ".
field_not_equal (" ")The field value is not identical to the text within the " ".
gt(n)The numeric field value is greater than the number or numeric field value n.
lt(n)The numeric field value is less than the number or numeric field value n.
count(n)Counts and matches the n items in a list.
in(“string1”, "string2", ..., "stringN")The string field value is equivalent to one of the strings in the parentheses.
not_in(“string1”, "string2", ..., "stringN")The string field value is not equivalent to any of the strings in the parentheses.
field_existsTests whether the field exists.
sum([adapter.field])Returns the sum of all the number values in the list. The field type of adapter.field is a list (array) of numbers.
  • then - then apply this value from the Adapter only to the assets whose field name starts with the value in starts_with.
  • form_fieldname - The field name in the Action. Use Autocomplete or the Dynamic Value Statement Wizard to choose the action field name or Use the Syntax Helper to find the correct action field name.
  • set_value - Tells the Action to set the value of form_fieldname to the value of the string or in the case that there is more than one string (item1 or item2 ... or itemN), to the first string that has a value.

More operators and functions are available than are used in these examples. See Enforcement Action Statement Syntax Table for a complete list of available statement elements and their syntax.

Note:

You cannot filter Enforcement Set query results using a switch/case statement. You can only filter them by performing data refinement on your saved query. Then, Dynamic Value statements will run only on the query results filtered according to the data refinement configuration (for all options with the exception of Refine field values by adapter connection).

Switch/Case Statement Examples

The following examples illustrate some ways Switch/Case statements can be used.

  • Example - Split the assets that match the query according to the value in hostname, and use that value to determine the action form email recipient.

    • If the hostname starts with "a", then set the email recipient to x@gmail.com
    • If the hostname starts with "b", then set the email recipient to y@gmail.com
    switch device.adapters_data.active_directory_adapter.hostname
    case starts_with ("a") then form.emailList set_value "x@gmail.com"
    case starts_with ("b") then form.emailList set_value "y@gmail.com"
    
  • Example - Split the assets that match the query according to the value of fieldA, and use that value to determine the action form tag_name.

    • If fieldA starts with "a", then set the tag name to "x".
    • If fieldB starts with "b", then set the tag name to "y".
    • If fieldA starts with "c", then set the tag name to "z".
    switch user.adapters_fieldA 
    case starts_with ("a") then form.tag_name set_value "x" 
    case starts_with ("b") then form.tag_name set_value "y"
    case starts_with ("c") then form.tag_name set_value "z"
    
  • Example - For all device adapters with qualys agent vulnerability score field value greater than 9, set the value of the Action form field number to 100.

    switch device.adapters_data.qualys_scans_adapter.qualys_agent_vulns.score 
    case gt(9) then form.field_number set_value 100
    




Was this article helpful?