Limited supportBMC provides limited support for this version of the product. As a result, BMC no longer accepts comments in this space. If you encounter problems with the product version or the space, contact BMC Support.BMC recommends upgrading to the latest version of the product. To see documentation for that version, see BMC AMI Command Center for Security 6.2.

Parenthetical nesting

You can change the order of precedence when evaluating expressions using balanced parentheses. You can also use this to leverage the associative and distributive properties of Boolean logic. If you do not use parentheses, then the expression is evaluated from left to right, by default.

Parentheses are often important and required when using the logical operators described in the Logical-operators.

Example

AA AND (BB OR CC) matches any message that contains AA and also contains either BB or CC or both. 

This is different from (AA AND BB) OR CC that matches any message that contains both AA and BB in any order, or the keyword CC.

Parenthesis can be nested to any level. When nesting parentheses, the parenthesis must be balanced.

Example

(AA AND (NOT BB)) OR (CC AND (DD OR EE)) is a valid expression and matches any message that contains AA and not BB, or contains CC and either DD or EE.

BMC Defender Server follows the special rules of the Boolean commutative, distributive and associative laws, as one would expect. The expression NOT (AA AND BB) is identical to (NOT AA) AND (NOT BB). Likewise, the expression (A AND B) OR (A AND C) is identical to the expression A AND (B OR C). Other Boolean laws, such as the Identity and Redundancy laws are also obeyed as one would expect. A good understanding of these laws is not absolutely necessary for creating logical expressions, but is helpful.

Note

To match the words AND, OR, XOR, NOT, or a parenthesis mark as part of an expression, you enclose these special keywords in single or double quotes.

Related topic

Simple-match-expressions

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*