Documentation Center
AlienVault® USM Anywhere™

Operators in the Orchestration Rules

AlienVault USM Anywhere allows you to use operators, which save time by focusing searches, in the rules to assign values to fields.

Orchestration Rules: Operators
Operator Meaning Example
Equals Compares the field to the specified value

Data Source Equals Okta

Equals, case insensitive Compares the field to the specified value, ignoring case considerations Packet Type Equals Log
Not Equals The value of the specified field does not match the specified value

Event Activity Not Equals Beacon

Not Equals, case insensitive The value of the specified field does not match the specified value, ignoring case considerations Event Activity Not Equals, case insensitive beacon
Is Empty Finds elements which have an empty value. It is the same as the Equals but with an empty string Event Name Is Empty
Is Not Empty Finds elements which do not have a value Source Asset ID Is Not Empty
Contains Checks for the presence of a substring in a string Event Name Contains Login Failed
Contains, case insensitive Checks for the presence of a substring in a string, ignoring case considerations Event Name Contains, case insensitive login failed
Is In CIDR Find elements that are included in the given IP Range (using CIDR notation) Source Asset ID Is In CIDR 192.168.0.0/24
Is Not In CIDR Find elements that are not included in the given IP Range (using CIDR notation) Source Asset ID Is Not In CIDR 192.168.0.0/24
Assign or Equal Assigns a value if empty or if the variable is populated it will act like Equals Username Assign or Equal [var_source_username]
In Searches for character and numeric values that are equal to one from a list of values. The list of values must be in parentheses, with each character value in quotation marks and separated by either a comma or blank

Event Name In Invalid User, Illegal User, Failed Password, RootHigh-level user account with full administrative privileges. Login Refused

In, case insensitive Searches for character and numeric values that are equal to one from a list of values. The list of values must be in parentheses, with each character value in quotation marks and separated by either a comma or blank, ignoring case considerations Event Name In, case insensitive invalid user, illegal user, failed password, root login refused
Match Finds elements that match a specified pattern using regular expressionsSequence of characters that define a search pattern. See also regex. Destination HostnameA hostname is a label that is assigned to a device connected to a computer network and is used to identify the device on the network. Match /.*\.google/
Match, case insensitive Finds elements that match a specified pattern using regular expressions, ignoring case considerations Destination Hostname Match, case insensitive /.*\.Google/
Greater than Returns true if the left operand is greater than the right operand

Src Port Greater than 10000

Less than Returns true if the left operand is less than the right operand Src Port Less than 100

About Possible Messages while Creating Rules

When you are creating a rule, you can get some of the following messages

Rules Messages
Message This Message is displayed when
At least one criterion is required besides packet type Packet Type is the unique criterion in the rule condition
All condition fields must have a value the condition value is missing
Case insensitive operator does not apply to numbers you select a case insensitive operator and the condition value is a number
A regular expression must be used with "Match" operator. Example ~ /value/ you select the Match operator and the condition value has to be a valid regexp
A variable expression must be used with "Assign or Equal" operator. Example >> varname you select the Assign or Equal operator and the condition value has to be a valid variable name between brackets
Some characters used could be part of a regular expression. Use "Match" operator your condition value contains * + [ or ] and the Match operator is not selected