When clause
Use a when clause to trigger part of a rule each time a specified slot of a previously processed event is modified or is assigned a specific value.
The when clause can be used in the Execute, Abstract, Correlate, and Propagate rule phases. Rules containing a when clause are evaluated completely when a new event is processed that matches the where condition of the rule. The when clauses in these rules are re-evaluated each time the processed event is modified so that it matches the when condition.
The general syntax of the when clause is as follows:
CallList is the part of the rule that is re-evaluated when the event is modified. The syntax for WhenCondition depends on whether you want the slots and conditions to be static or dynamic.
To trigger the when clause when a specified slot changes, use the syntax in the following figure.
when condition triggered by any change to a specified slot
The following figure, the name of an existing variable must be specified and the name of the slot to be monitored for changes. The when clause is triggered each time the specified slot changes.
To trigger the when clause when a specified slot changes to a specified value, use the syntax in the following figure:
when condition triggered by a specific change to a specified slot
In the following figure, the name of an existing variable must be specified and the name of the slot must monitored for changes. The when clause is triggered only when the slot value changes to match the operator and condition expression specified by Op Condition.
When the slot name and/or the condition are not known in advance, use the syntax in the following figure:
when condition triggered by a specific change to a specified slot
the precceeding figure, $ VarName is the name of an existing variable. If $ VarName is not specified, the variable used in the where clause of the rule is used. The slot name is determined dynamically by evaluating the expression SlotExpr, which must result in a valid slot name.
The condition that the slot must meet is also specified dynamically. The operator is determined by evaluating the expression OpExpr, which must result in a valid operator name. The conditional expression is derived by evaluating the expression CondExpr. CondExpr is evaluated twice—once to determine a conditional expression and a second time to evaluate whether the slot matches that conditional expression.
When an event is modified by a rule containing a when clause so that it becomes a candidate for evaluation by another rule, that evaluation does not take place immediately. Instead, the request is queued for the rule engine to process after all other pending requests or events are processed.
when class example
Rule containing a when clause
using { NOTIFY_RULE($N) where [$N.object_class == $E.mc_object_class] }
when($N.trigger_slot,$N.trigger_op,$N.trigger_expr)
{
...
}
Sample data
NOTIFY_RULE; object_class=CLS2; trigger_slot=status; trigger_op=within; trigger_expr='[ACK,ASSIGNED]'; END
- For object class CLS1, the when clause is triggered when the event's severity is MAJOR or higher.
- For object class CLS2, the when clause is triggered when the event's status is within ACK, ASSIGNED.
Note for object class CLS2, the list value of trigger_expr must be within single quotation marks to form a STRING type value, instead of a LIST. The arguments used in the when clause must be type STRING.