Special operators

hasTag

Evaluates to true if the specified tag is applied to the system.

(hasTag EPOLeafNode.AppliedTags 'fullTagName')

containsTag

Evaluates to true if any tags applied to the system contain the specified partial tag name.

(containsTag EPOLeafNode.AppliedTags 'partialTagName')

hasTagExcluded

Evaluates to true if the specified tag is excluded on the system.

(hasTagExcluded EPOLeafNode.AppliedTags 'excludedTagName')

doesNotHaveTag

Evaluates to true if the specified tag is not applied to the system.

(doesNotHaveTag EPOLeafNode.AppliedTags 'fullTagName')

doesNotHaveAnyTag

Evaluates to true if the system has no tags applied to it.

(doesNotHaveAnyTag EPOLeafNode.AppliedTags)

childOf

Returns rows that are direct descendants of the given nodes.

(childOf EPOLeafNode.parentId <nodeId1> <nodeId2> ...)

descendsFrom

Returns rows that are descended from the given nodes.

(descendsFrom EPOLeafNode.parentId <nodeId1> <nodeId2> ...)

stateEq

Evaluates to true if the managed state of the system matches either "managed" or "unmanaged".

(stateEq EPOLeafNode.ManagedState ["managed"|"unmanaged"])

version_eq

Evaluates to true if the versions are equal using dotted version notation.

(version_eq EPOMasterCatalog.ProductVersion '3.1.4.1')

version_neq

Evaluates to true if the versions are not equal using dotted version notation.

(version_neq EPOMasterCatalog.ProductVersion '3.1.4.1')

version_ge

Evaluates to true if the first version is greater or equal to the second using dotted version notation.

(version_ge EPOMasterCatalog.ProductVersion '3.1.4.1')

version_lt

Evaluates to true if the first version is less than the second using dotted version notation.

(version_lt EPOMasterCatalog.ProductVersion '3.1.4.1')

threatcategory_belongs

Returns the row if the threat category belongs to the given group.

(threatcategory_belongs EPOEvents.ThreatCategory 'av')

threatcategory_not_belongs

Returns the row if the threat category does not belong to the given group.

(threatcategory_not_belongs EPOEvents.ThreatCategory 'av')

withinRepositoryDatVersion

Evaluates to true if the DAT version is within a supplied number of versions to what is in the repository.

(withinRepositoryDatVersion EPOProdPropsView_VIRUSCAN.datver 3)

not_withinRepositoryDatVersion

Evaluates to true if the DAT version is not within a supplied number of versions to what is in the repository.

(not_withinRepositoryDatVersion EPOProdPropsView_VIRUSCAN.datver 3)