Unsupported content


This version of the documentation is no longer supported. However, the documentation is available for your convenience. You will not be able to leave comments.

Defining a conditional construct

Conditional constructs are common building blocks of discovery signatures and compliance rules.

Conditional constructs organize multiple conditions (basic conditions or even loops) in an if-then-else logical sequence, creating complex expressions for evaluation.

A conditional construct always begins with one if-then block, which pairs two conditions together. The second condition in this pair is evaluated for TRUE/FALSE outcome only if the condition that preceded it returned a TRUE value.

After the initial if-then block, you can insert any number of optional elseif-then blocks. Again, each elseif-then block pairs two conditions, and the second condition in each pair is evaluated only if the condition that preceded it returned a TRUE value.

Finally, before the end of the full conditional construct, you can insert one last optional else statement, with a condition to be evaluated if all preceding if and elseif conditions returned FALSE values.

A conditional construct can be combined with basic conditions or nested within a loop. A conditional construct can also be enclosed within another conditional construct.


The following simple if-then-else conditional construct contains several basic conditions:

   ??TARGET.OS?? = "Windows"
   "File:/C/a.log".size does not equal 3
   ??TARGET.OS?? = "LINUX"
   "File:/C/a.log".size does not equal 4
   "File:/C/a.log".size does not equal 5

To define a conditional construct

  1. To insert the main if-then block of the conditional construct, click the drop-down arrow beside the New Condition icon and select the If... Then... End option.
  2. Define a pair of conditions or loops for the if-then block, in the following manner:
    1. Select the if line.
    2. Click the New Condition icon for a basic condition, or click the drop-down arrow beside this icon and select from the full range of available condition types.
      • Basic Condition for a basic condition
      • Foreach Loop, Count Loop, or Exists Loop for the loop of your choice
    3. In the displayed fields, define the condition as discussed in one of the following topics:
    4. Double-click the then line and repeat steps b and c for the condition or loop that depends on the TRUE/FALSE outcome of the preceding condition or loop.

  3. (Optional) To insert an elseif-then block, select the line above where you want to insert it, and then click the drop-down arrow beside the New Condition icon and select the Elseif option. Then insert a pair of conditions — one after the elseif line and the other after the then line — as described in step 2 for the if-then block.
    Repeat this step for any number of elseif-then blocks that you want to create.
  4. (Optional) To insert an else statement before the end line, use the Else option from the drop-down arrow beside the New Condition icon, and then insert one condition after the else line.
Was this page helpful? Yes No Submitting... Thank you