45. Appendix 4 – Conditional Parameters & Dynamic Parameters

The columns from the tables listed below contain the following data:

● Conditional Parameter is used to restrict the execution of the actions contained in Responses
● Dynamic Parameter is a placeholder token (variable) that can be used as parameter or script argument in most Response actions because, at run-time, the software translates it into the requested value. Each dynamic parameter is defined within curly brackets
● Data Type shows the returned value type and which comparison operators are accepted by the Conditional Parameter:
• String returns a variable-length string. It accepts the comparison operators:
▪ equal to - it implies a perfect match without any differences. E.g. if the Conditional Parameter is “apple” and the Value is also “apple”, then equal to is true
▪ not equal to - it implies any difference qualifies for this condition to be true. E.g. if the Conditional Parameter is “apple” and the Value is “orange”, then not equal to is true
▪ includes - the “Value” can be a part or a segment of the “Conditional Parameter”. E.g. if the Conditional Parameter is “apple pie” and the Value is “apple”, then includes is true because “apple pie” contains “apple”
▪ included in - is true if the “Value” contains the “Conditional Parameter” as a substring. This is the inverse relationship of includes. E.g. if the Conditional Parameter is “apple” and the Value is “apple pie”, then included in is true because “apple” is part of the larger string “apple pie”
▪ excludes - is true if the “Conditional Parameter” does not contain the “Value” as a substring. This indicates the absence of the “Value” within the “Conditional Parameter”. E.g. if the Conditional Parameter is “apple pie” and the Value is “cherry”, then excludes is true because “apple pie” does not contain “cherry”
▪ excluded from - is true if the “Value” does not contain the “Conditional Parameter” as a substring. This is the opposite of included in. E.g. if the Conditional Parameter is “cherry” and the Value is “apple pie”, then excluded from is true because “cherry” is not part of “apple pie”
▪ regexp - is true when the “Conditional Parameter” matches the regular expression from “Value”. E.g. when “Value” is “[A-Z]”, the precondition is true only when the “Conditional Parameter” contains an upper-case letter
• Integer returns a 64-bit unsigned integer number. It accepts the comparison operators:
▪ equal to - is true when “Conditional Parameter” and “Value” are identical
▪ not equal to - is true when “Conditional Parameter” and “Value” are not identical
▪ greater than - is true when “Conditional Parameter” is larger than “Value”
▪ less than - is true when “Conditional Parameter” is smaller than “Value”
▪ divisible by - is true when “Conditional Parameter” can be divided by “Value” without leaving a remainder
• Integer* accepts the same comparison operators as Integer. The values can be returned in multiples of 1,000 by appending “_kilo” to the dynamic parameter name. The same goes for 1,000,000 by appending “_mega” and for 1,000,000,000 by appending “_giga”. To return the value and the biggest multiplier (k, M, G) for the value, append “_prefix”. To also return the decoder before the biggest multiplier (k, M, G) value, append “_decoder_prefix”
• Float returns an unsigned floating point number when the comparison operator is greater than or less than, or an unsigned integer when the comparison operator is equal to, not equal to or divisible by
• Prefix returns a string containing a subnet or IP. It accepts the comparison operators equal to, not equal to, includes, included in, excludes and excluded from. The inclusion/exclusion operators compare prefixes, not strings
● Description provides a short explanation of the parameter

45.6. System-Wide Tokens

#

Conditional Parameter

Dynamic Parameter

Data Type

Description

1

Anomalies (all Sensors, Decoders, Prefixes)

{anomalies}

Integer

Returns the total number of active anomalies from any Sensor, Decoder (incl. Unit) or Prefix

2

Anomalies (same Sensor)

{anomalies_sensor}

Integer

Returns the total number active anomalies from the same Sensor

3

Anomalies (same Decoder)

{anomalies_decoder}

Integer

Returns the total number active anomalies from the same Decoder and Unit (pkts/s or bits/s)

4

Anomalies (same Sensor, Decoder)

{anomalies_sensor_decoder}

Integer

Returns the total number active anomalies from the same Sensor and Decoder and Unit (pkts/s or bits/s)

5

Anomalies (same Sensor, Decoder, Prefix/24)

{anomalies_sensor_decoder_cidr_24}

Integer

Returns the total number active anomalies from the same Sensor, Decoder, Unit (pkts/s or bits/s) and Prefix/24