Operand data types and operator compatibility

The various operands that are available in conditions are based on a range of data types. All parts of a condition — LHS operand, operator, and RHS operand — must be based on the same data type. The following table lists and describes all comparison operators that are available for selection in conditions and specifies the operand data types that each operator supports.

Note

The following additional operators are not used to analyze the LHS operand or to compare it with the RHS operand. Instead, you use these operators to assign a value to a property, so that you can then use the property as a variable in subsequent conditions in your Compliance rule. These operators support all data types.

  • The assign operator can be used to assign a transient value that is not saved to the database, but rather temporarily stored only for the duration of rule execution. Use this operator if you want to avoid unnecessary storage of data in the database and do not plan to perform remediation based on the results of the compliance rule analysis.
  • The persist operator can be used to assign a value that is persisted in the database. Use this operator if you plan to perform remediation based on the results of the compliance rule analysis. Note that this operator will not work for template level property and target level property. Use this operator for custom properties only.

The remediate operator is another special operator that does not analyze the LHS operand. Instead, this operator executes a shell command (specified in the LHS operand as a Command configuration object) as a remediation action at the end of compliance analysis. This operator is typically used in a then statement within a conditional construct.

Warning

Parts that are used in a condition are collected even before the condition is evaluated. Therefore, whenever you include a part in a condition with the purpose of setting information on the operating system, ensure that the line ends with a remediate operator. Use the remediate operator, for example, whenever you include commands such as touch, rm, cp, mv, sed, awk, any command with > or >>, or whenever you call a custom script or executable.

Operator

Operand data type

Expression returns TRUE if...

after

Date

the date property of the LHS operand is chronologically after the date specified by the RHS operand

before

Date

the date property of the LHS operand is chronologically before the date specified by the RHS operand

between

  • Date
  • Decimal
  • Integer

the LHS operand value falls within the range defined by two RHS operands

contains

  • Long Text
  • String

the LHS operand contains the string defined by the RHS operand

contains (case sensitive)

  • Long Text
  • String

the LHS operand contains the case-sensitive string defined by the RHS operand

count between

not relevant (cardinality condition)

the number of occurrences of the configuration object falls within the range defined by two RHS operands

count does not equal

not relevant (cardinality condition)

the number of occurrences of the configuration object specified in the LHS operand does not equal the value defined by the RHS operand

count equals

not relevant (cardinality condition)

the number of occurrences of the configuration object specified in the LHS operand equals the value defined by the RHS operand

count greater than

not relevant (cardinality condition)

the number of occurrences of the configuration object specified in the LHS operand is greater than the value defined by the RHS operand

count greater than or equal to

not relevant (cardinality condition)

the number of occurrences of the configuration object in the LHS operand is greater than or equal to the value defined by the RHS operand

count is not one of

not relevant (cardinality condition)

the number of occurrences of the configuration object specified in the LHS operand is not one of the values defined by the RHS operand

count is one of

not relevant (cardinality condition)

the number of occurrences of the configuration object specified in the LHS operand is one of the values defined by the RHS operand

count less than

not relevant (cardinality condition)

the number of occurrences of the configuration object specified in the LHS operand is less than the value defined by the RHS operand

count less than or equal to

not relevant (cardinality condition)

the number of occurrences of the configuration object specified in the LHS operand is less than or equal to the value defined by the RHS operand

does not contain

  • Long Text
  • String

the LHS operand does not contain the string defined by the RHS operand

does not contain (case sensitive)

  • Long Text
  • String

the LHS operand does not contain the case-sensitive string defined by the RHS operand

does not end with

  • Long Text
  • String

the LHS operand does not end with the string defined by the RHS operand

does not end with (case sensitive)

  • Long Text
  • String

the LHS operand does not end with the case-sensitive string defined by the RHS operand

does not equal

all data types

the LHS operand does not equal the string or number defined by the RHS operand

does not equal (case sensitive)

  • Long Text
  • String

the LHS operand does not equal the case-sensitive string defined by the RHS operand

does not exist

not relevant (cardinality condition)

the configuration object specified in the LHS operand is not present (the number of occurrences equals zero)

does not have any flag

UNIX Permission

the LHS operand does not have any flag matching any of the multiple UNIX permissions defined by the RHS operand

does not have flag

UNIX Permission

the LHS operand does not have a flag matching the UNIX permission defined by the RHS operand

does not match

  • Long Text
  • String

the LHS operand does not match the string defined by the RHS operand

does not match mask

FilePermission ACE

the LHS operand does not match the mask defined by the RHS operand

does not start with

  • Long Text
  • String

the LHS operand does not start with the string defined by the RHS operand

does not start with (case sensitive)

  • Long Text
  • String

the LHS operand does not start with the case-sensitive string defined by the RHS operand

ends with

  • Long Text
  • String

the LHS operand ends with the string defined by the RHS operand

ends with (case sensitive)

  • Long Text
  • String

the LHS operand ends with the case-sensitive string defined by the RHS operand

equals

all data types

the LHS operand equals the string or number defined by the RHS operand

equals (case sensitive)

  • Long Text
  • String

the LHS operand equals the case-sensitive string defined by the RHS operand

exists

not relevant (cardinality condition)

the configuration object specified in the LHS operand is present at least once (the number of occurrences is one or more)

greater than

  • Decimal
  • Integer

the LHS operand value is greater than the value defined by the RHS operand

greater than or equal to

  • Decimal
  • Integer

the LHS operand value is greater than or equal to the value defined by the RHS operand

has ACE matching mask

  • FileAudit ACE
  • FilePermission ACE
  • RegistryAudit ACE
  • RegistryPermission ACE

the LHS operand has an ACE mask matching the one defined by the RHS operand

has all flags

UNIX Permission

the LHS operand does not have a flag matching the UNIX permission defined by the RHS operand

has any flag

UNIX Permission

the LHS operand has any flag matching the UNIX permission defined by the RHS operand

has flag

UNIX Permission

the LHS operand have a flag matching the UNIX permission defined by the RHS operand

has no ACE matching mask

  • FileAudit ACE
  • FilePermission ACE
  • RegistryAudit ACE
  • RegistryPermission ACE

the LHS operand has no ACE mask matching the one defined by the RHS operand

has no flags

UNIX Permission

the LHS operand has no flags matching the UNIX permission defined by the RHS operand

has only ACEs matching masks

  • FileAudit ACE
  • FilePermission ACE
  • RegistryAudit ACE
  • RegistryPermission ACE

the LHS operand has only ACE masks matching the ones defined by the RHS operand

instance of

String

the LHS operand has an instance of the string defined by the RHS operand

is not one of

all data types

the LHS operand is not one of the items defined by the RHS operand

is not substring of

  • Long Text
  • String

the LHS operand is not a substring of the string defined by the RHS operand

is not substring of (case sensitive)

  • Long Text
  • String

the LHS operand is not a case sensitive substring of the string defined by the RHS operand

is one of

all data types

the LHS operand is one of the items defined by the RHS operand

is substring of

  • Long Text
  • String

the LHS operand is a substring of the string defined by the RHS operand

is substring of (case sensitive)

  • Long Text

the LHS operand is a case sensitive substring of the string defined by the RHS operand

less than

  • Decimal
  • Integer

the LHS operand value is less than the value defined by the RHS operand

less than or equal to

  • Decimal
  • Integer

the LHS operand value is less than or equal to the value defined by the RHS operand

matches

  • Long Text
  • String

the LHS operand matches the string defined by the RHS operand

The matches operator evaluates regex expressions compatible with the Java implementation of regex.

matches mask

FilePermission ACE

the LHS operand matches the ACE file permission defined by the RHS operand

newer than days

Date

the date property of the LHS operand is chronologically newer than the number of days specified by the RHS operand

not instance of

String

the LHS operand is not an instance of the string defined by the RHS operand

older than days

Date

the date property of the LHS operand is chronologically older than the number of days specified by the RHS operand

starts with

  • Long Text
  • String

the LHS operand starts with the string defined by the RHS operand

starts with(case sensitive)

  • Long Text
  • String

the LHS operand starts with the case sensitive string defined by the RHS operand

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*