Using Functions and Keywords
  • 06 Mar 2023
  • 4 Minutes to read
  • Dark
    Light
  • PDF

Using Functions and Keywords

  • Dark
    Light
  • PDF

The following functions and keywords can be used in condition statements:

Using min/max Functions

The min/max functions work for all statement types and for both numeric and alphabetic values. It sets the value of the field in the Enforcement Action to the min/max value of the field indicated in the min/max clause.

It has the syntax:

set_value min([....])
or
set_value max([....])
  • Example - Sets the value of the form.field_integer field to the maximum value found in the device.specific_data.data.software_cves.cvss3_score field.
    device all then form.field_integer set_value max([device.specific_data.data.software_cves.cvss3_score])
    
  • Example - Sets the value of the form.field_integer field to the minimum value found in the device.specific_data.data.software_cves.cvss3_score field.
    device all then form.field_integer set_value min([device.specific_data.data.software_cves.cvss3_score])
    

Using the min/max Functions with Multiple Fields

The min/max functions can return the minimum or maximum value from multiple fields. The minimum or maximum value from each field is found and then the minimum or maximum of those values is used.

It has the syntax:

set_value min([....],[....],...)
or
set_value max([....],[....],...)


  • Example - Sets the value of the form.field_integer field to the maximum value found in either of these fields:
    • device.specific_data.data.software_cves.cvss3_score
    • adapters_data.tenable_security_center_adapter.software_cves.cvss2_score
device all then form.field_integer set_value max([device.specific_data.data.software_cves.cvss3_score], [adapters_data.tenable_security_center_adapter.software_cves.cvss2_score])

Using add and multiply Functions

The add and multiply functions can be used in the same way as concat or sum.

add has the syntax:

add (value, value,...)

multiply has the syntax:

multiply([some.field.name], value)

For example:

device all form.field_int then set_value
add (multiply ([custom.asset_criticality], 0.4), multiply ([custom.asset_severity], 0.6)

Example

If custom.asset_criticality = x

and

custom.asset_severity = y

then

the result = 0.4x + 0.6y

Using Boolean Operators in Case Statements

The Boolean operators true and false can be used in switch/case statements to test the value of a Boolean field.

  • Example - If device.rapid7.some_boolean_field has the value true, then set it to 1234. If its value is false, set its value to 4567.

     switch device.rapid7.some_boolean_field
     case field_equal (true) then set_value “1234”
     case field_equal (false) then set_value “4567”
    

Using the contains Operator

The contains operator for switch statements applies the Enforcement action if the string or array contain the indicated value:

  • A string may contain a sub-string.
  • An array must contain the exact value.

It has the syntax:

switch some.field.name case contains("value")...
  • Example - This statement verifies that “TAG” is one of the device labels. (e.g. for labels list that will return true: [“123”, “TAG”, “ANOTHER”].
    switch device.labels case contains("TAG") then...
    
  • Example - This statement verifies that “ABC” is a substring of the asset name. (e.g. “ABCDEFG” as asset name will return true).
    switch device.specific_data.name case contains("ABC”) then...
    

Using the join Function for Array Fields

The join function concatenates strings into one single string with the items separated by a delimiter. The delimiter can be any character.

It has the syntax:

join (items, delimiter)
  • Example - Join the values in field into a single string with the values separated by a comma and a space.

    join([field], “, ”)
    
  • Example - Join the listed values into one string with the values separated by semicolon and a space.

    join([“string_1”, “string_2”], “; “) 
    

    The output will be

    *string1, string2*.
    
  • Example - Concatenate a list with a string using join.
    You can use nested functions to concatenate a list with a string. For example:

    concat (join ([field.array.1], “,”), “and”, [field.mystring]), “comment”)
    

    This statement will generate a (single string) value of:

    itemarray1, itemarray2, itemarrayn and mystring comment
    

Using the split Function

The split function splits the string in the indicated field by the specified delimiter.

The systax is:

split([field], delimiter)
  • Example - A string is split at the delimiter character of $.
split(“My$Cool$String”, “$“) 

The output will be a list:

[“My”, “Cool”, “String”]

Using the field_exists Function

The field_exists function tests whether the specified field exists.

switch adapterfield1
case field_exists then form.field set_value “exists”

Tests whether the field adapterfield1 exists. If true, sets the value of adapterfield1 to "exists".

Setting a Rule to be Case Insensitive

You can tell a rule to ignore case by adding 'i' after the rule.

For example, to make these rules case-insensitive:

  • (field_a in field_b) - Add the i after the rule: (field_a in field_b)i
  • (fielda == fieldb) - Add the i after the rule: (fielda == fieldb)i

Case Sensitive Comparison Rules

The == comparison rule is case sensitive. The two values must match exactly to test True. Otherwise, the comparison will test False.

The = comparison rule is case insensitive. The two values may be different in case. For example, field and FieLD would test True.

Nesting Functions

You can nest functions (functions within functions) when writing condition statements.

  • Example - The following statement includes a sum function within the concat function:

    device all then form.tag_name set_value concat("sum is", sum([device.specific_data.data.field]))
    


Changing your password will log you out immediately. Use the new password to log back in.
First name must have atleast 2 characters. Numbers and special characters are not allowed.
Last name must have atleast 1 characters. Numbers and special characters are not allowed.
Enter a valid email
Enter a valid password
Your profile has been successfully updated.