Using the Dynamic Value Statement Wizard
  • 25 Jan 2024
  • 6 Minutes to read
  • Dark
    Light
  • PDF

Using the Dynamic Value Statement Wizard

  • Dark
    Light
  • PDF

Article Summary

You can create Dynamic Value Statements using the following methods:

This page explains how to create Dynamic Value Statements using the Wizard.

Note:

Before configuring a Dynamic Value Statement, do the following:

  • In the Enforcement Set configuration, in the Module dropdown, select the assets on which to run the query.
  • Fill in default values for the action fields that are below the statement. These will be the fallback values for the Dynamic Value Statement.

Creating a Dynamic Value Statement Using the Wizard

Adding an All Statement

This section describes how to construct an All statement using the Wizard.
You can use the Wizard to construct a simple set-value statement or an alternative of statements using or.
You can define multiple adapter fields as possible sources for the value of the action field. The adapter fields are checked for values in the order that they are defined (top to bottom). When a value is found in a field, it is assigned to the action field, and the remaining adapter fields are ignored and not processed. If none of the fields in the OR clauses have a value, the default value (fallback) defined in the action field is used.
Learn more about All Statement Syntax.

To construct an All statement

  1. Click Wizard. The wizard for creating an All statement opens.

WizardAllStatement

  1. From the Select form field dropdown, select the action field to populate.
  2. In the Adapter and Select Adapter Field dropdowns, select the adapter and its field whose value is to populate the action field (in Step 2). Learn more about how to select an adapter and how to select an adapter field.
Note:

The module (asset type) must be set in order to select an adapter and adapter field. If you did not select a module, the following tooltip is displayed when you attempt to select an adapter field: Select entity type in enforcement set query to get relevant fields.

  1. Click + Add Alternative to add an OR clause to the statement and repeat step 3. The screen below shows an All statement with several OR statements.
  2. Repeat step 4 for each OR clause that you want to add to the statement.

WizardCOmpleted

  1. When done, click Syntax to view the statement created by the Wizard, and then click Validate for the system to automatically verify the statement syntax.
Note:

The Syntax button is enabled only after you have completed a statement in the Wizard. Otherwise, the button is disabled and the following notification is displayed: Incomplete statement cannot be displayed in syntax.

Adding a Switch/Case Statement

This section describes how to construct a Switch/Case statement using the Wizard.

Learn more about Switch/Case Statement Syntax.

To construct a Switch/Case statement

  1. Click Wizard, and then click Switch to value by condition. The wizard for creating a Switch/Case statement opens.

SwitchtoValueForConditon

  1. Configure the Switch part of the statement:
    1. From the Adapter and Select Adapter Field dropdowns, select the adapter and adapter field. Learn more about how to select an adapter and how to select an adapter field.
    2. From the Select operator dropdown, select the operator to use on the adapter field value, and in Write, type the value to compare to the field value using the operator.
Note:

The module (asset type) must be set in order to select an adapter and adapter field. If you did not select a module, the following tooltip is displayed when you attempt to select an adapter field: Select entity type in enforcement set query to get relevant fields.

  1. Configure the Case part of the statement:

    1. From the Select form field dropdown, select the action field that you want to populate.
    2. Select whether to populate the action field with an adapter field or custom input.
      • Adapter field - For this choice, from the Adapter and Select Adapter Field dropdowns, select the adapter and adapter field.
      • Custom Input - For this choice, type a value in the Value (Write) box.
  2. Click Add Condition to add an ELSE IF clause to the statement and repeat steps 2b and 3.

Note:

The adapter and adapter field cannot be changed in the ELSE IF clauses.

  1. Repeat step 4 for each ELSE IF clause to add to the statement.

  2. When done, click Syntax to view the statement created by the Wizard, and then click Validate to automatically verify the statement syntax.

Note:

You can click Remove Condition to remove any condition except the first. This button appears from the second condition onward.

Selecting an Adapter

The Adapter dropdown contains a list of all adapters that fetched data for assets. The adapter that you select from this dropdown controls the list of fields displayed in the Adapter Field dropdown.

The first entry and default selection in this dropdown is Aggregated represented by the image.png icon. All Aggregated fields contain the aggregated (i.e., collated) values from all of the data that was fetched for all adapters, considered as common fields.

Selecting an Adapter Field

The Select Adapter Field dropdown contains a list of all the fields on that adapter. In the case of the Aggregated selection in the Adapter dropdown, this is a list of all fields whose data is collated from all adapters.

Converting from Wizard to Syntax

You can construct a statement in the Wizard screen and then convert and view its Syntax.

Click the Syntax button to convert Wizard to Syntax.

Note that the Syntax button is disabled in the following cases and a tooltip is displayed:

  • Not all fields are filled in the Wizard. Tooltip: Incomplete statement cannot be displayed in syntax.
  • You didn't yet choose a module and can therefore not choose an adapter field, as the available adapter fields are dependent on choosing a module. Tooltip: Incomplete statement cannot be displayed in syntax.

In these cases, when you save the Enforcement Set, an empty dynamic value statement is saved.

Converting from Syntax to Wizard

You can construct a statement in the Syntax screen and then convert and view it in the Wizard. Click the Wizard button to convert syntax to wizard.

Note that the Wizard button is disabled in the following cases and a tooltip is displayed::

  • The statement is too complex to display in the Wizard. Tooltip: Statement is too complex to display in wizard.
  • Syntax was not validated successfully. Tooltip: Invalid statement cannot be displayed in wizard.
  • You didn't yet choose a module and can therefore not choose an adapter field, as the available adapter fields are dependent on choosing a module. Tooltip: Incomplete statement cannot be displayed in wizard.

Examples

All Statement Example

The following screen shows an All statement example built in the Wizard.
For each vulnerability that matches the query, it assigns the action field Tag names the first non-empty value of the following adapter fields:

  • CVE Impact Score
  • CVSS V2 Score
  • CVSS V3 Score

ExampleAllStatement

You can click the Syntax button to translate the statement constructed in the Wizard to syntax and validate it.
ExampleAllStatementSyntax

Switch/Case Statement Example 1

The following screen shows a Switch/Case statement example built in the Wizard.
For each vulnerability that matches the query, it checks if the CVSS V2 Score field in the Aggregated adapter is greater than 2 (the first condition).
If yes, the action field Tag names is assigned the value of the CVSS V2 Score adapter field.
If not, it checks if the CVSS V2 Score field in the Aggregated adapter is less than 2 (the second condition). If yes, the action field Tag names is assigned the value 0.
If none of the conditions are met, the action field Tag names is assigned the value fallback, defined as the default value in the action configuration form.

ExampleSwitchStatement

You can click the Syntax button to translate the statement constructed in the Wizard to syntax and validate it.

ExampleSwitchStatementSyntax

Switch/Case Statement Example 2

The following screen shows a Switch/Case example built in the Wizard.
For each device that matches the query, it checks if the Asset Name field in the Aggregated adapter meets the criteria listed in the first condition. If it does, the action field is assigned the value of the adapter field. If not, the next condition is checked. Once the Asset Name field value meets the criteria, the remaining ELSE IF conditions are not processed.

ExampleSwitchStatement2a

You can click the Syntax button to translate the statement constructed in the Wizard to syntax and validate it.

ExampleSwitchStatement2aSyntax



Was this article helpful?

Changing your password will log you out immediately. Use the new password to log back in.
First name must have atleast 2 characters. Numbers and special characters are not allowed.
Last name must have atleast 1 characters. Numbers and special characters are not allowed.
Enter a valid email
Enter a valid password
Your profile has been successfully updated.