Rules and logical connectors
A rule consists of an item, logical connector (logical operator) and defined value.
When you click + Add Rule a pop-up window will open with a list of items divided into categories. For example:
Installed software > Application name
Network adapters > MAC address
OS edition > OS name
You can browse the list of all available rules in this ESET Knowledgebase article.
To create a rule, select an item, choose a logical operator and specify a value. The rule will be evaluated according to the value you've specified and the logical operator used.
Acceptable value types include number(s), string(s), enum(s), IP address(es), product masks and computer IDs. Each value type has different logical operators associated with it and ESET PROTECT Web Console will automatically show only supported ones.
•"= (equal)" - Symbol value and template value must match. Strings are compared without case sensitivity.
•"> (greater than)" - Symbol value must be greater than template value. Can also be used to create a range comparison for IP address symbols.
•"≥ (greater or equal)" - Symbol value must be greater or equal to template value. Can also be used to create a range comparison for IP address symbols.
•"< (less than)" - Symbol value must be less than template value. Can also be used to create a range comparison for IP address symbols.
•"≤ (less or equal)" - Symbol value must be less than or equal to template value. Can also be used to create a range comparison for IP address symbols.
•"contains" - Symbol value contains template value. In case of strings, this searches for a sub-string. Search is done without case sensitivity.
•"has prefix" - Symbol value has the same text prefix as template value. Strings are compared without case sensitivity. Set the first characters from your search string, for example, for "Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319", the prefix is "Micros" or "Micr" or "Microsof"etc.
•"has postfix" - Symbol value has same text postfix as template value. Strings are compared without case sensitivity. Set the first characters from your search string, for example, for "Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319", the postfix is "319" or "0.30319", etc.
•"has mask" - Symbol value must match a mask defined in a template. Mask formatting allows any characters, the special symbols '*' - zero, one or many characters and '?' exactly one character, e.g.: "6.2.*" or "6.2.2033.?".
•"regex" - Symbol value must match the regular expression (regex) from a template. Regex must be written in Perl format.
|
A regular expression, regex or regexp is a sequence of characters that define a search pattern. For example, gray|grey and gr(a|e)y are equivalent patterns which both match these two words: "gray", "grey". |
•"is one of" - Symbol value must match any value from a list in a template. To add an item, click + Add. Each line in a new item in the list. Strings are compared without case sensitivity.
•"is one of (string mask)" - Symbol value must match any mask from a list in a template. Strings are compared with case sensitivity. Examples: *endpoint-pc*, *Endpoint-PC*.
•"has value"
Negated operators:
|
Negated operators must be used with care, because in the case of multiple line logs such as "Installed application", all lines are tested against these conditions. Please consult the included examples (Template rules evaluation and Dynamic Group template - examples) to see how negated operators or negated operations must be used to get expected results. |
•"≠ (not equal)" - Symbol value and template value must not match. Strings are compared without case sensitivity.
•"doesn't contain" - Symbol value does not contain template value. Search is done without case sensitivity.
•"doesn't have prefix" - Symbol value does not have the same text prefix as template value. Strings are compared without case sensitivity.
•"doesn't have postfix" - Symbol value does not have text postfix as template value. Strings are compared without case sensitivity.
•"doesn't have mask" - Symbol value must not match a mask defined in a template.
•"not regex" - Symbol value must not match a regular expression (regex) from a template. Regex must be written in Perl format. Negation operation is provided as a helper to negate matching regular expressions without rewrites.
•"is not one of" - Symbol value must not match any value from the list in a template. Strings are compared without case sensitivity.
•"is not one of (string mask)" - Symbol value must not match any mask from a list in a template.
•"has no value"