KSC Open API
Kaspersky Security Center API description
Logical expressions format

The logical expression has following format:

        expression ::= log_subexpr | comp_exp
    

Definition of log_subexpr is included in the table below.

NameValue
"LOP"KLLX_LOP_*, logical operation (paramInt).
"ARGS"(paramArray), each entry is (paramParams) and contains either log_subexpr or comp_exp.

Definition of comp_exp is included in the table below.

NameValue
"OP"KLLX_COP_*, comparison operation. The value of the data source attribute "name" is the first operand and the value "val" from the expression is the second operand (paramInt).
"name"attribute_name, the first operand (paramString).
"val"attribute value, the second operand. If absent, "another" is used, the type must be the same as the attribute type in the data source.
"another"attribute_name, the second operand. Required if "val" is absent, otherwise ignored (paramString).

Sample of "EXPRESSION":

        (&(strAttr1 = 'val1')(nAttr2 < 100)(|( exists nAttr3 )(strAttr4 <> strAttr5)))
    

The logical expression is typically stored in the "EXPRESSION" variable that is (paramParams), and must contain either the logical (log_subexpr) or compare (comp_exp) operation. If the logical expression contains logical operation, the following attributes must be present:

  • "LOP" - Logical operation code, one of integer constants: KLLX_LOP_* (see below).
  • "ARGS" - Array (paramArray) of logical operation arguments. Each entry is (paramParams) and contains either log_subexpr or comp_exp.

Logical operation codes:

LOP symbolic nameLOP IDDescriptionType
KLLX_LOP_AND1Logical 'AND'Binary operation
KLLX_LOP_OR2Logical 'OR'Binary operation
KLLX_LOP_NOT3Logical 'NOT'Unary operation

If using an OR comparison operation, the following attributes must be present:

  • "OP" - Comparison operation code, one of the integer constants KLLX_COP_* (see below).
  • "name" - (paramString) name of the attribute from the data source (the first operand). This operand will be compared with the second operand ("val" or "another"). Either "val" or "another" also must be specified.
  • "val" - Value of the attribute (the second operand). This attribute is required if "another" is absent. This attribute must be absent if KLLX_ATTR_OTHERNAME is specified. This attribute must be absent if "OP" is KLLX_COP_EX or KLLX_COP_NEX. The type must be the same as the type of the "name" attribute.
  • "another" - (paramString) contains name of the attribute from the data source (the second operand). The type of the variable must be the same as the type of the "name" attribute. This attribute is required if "val" is absent, otherwise ignored. This attribute must be absent if "name" is KLLX_COP_EX or KLLX_COP_NEX.

Comparison operation codes name are listed below:

COP symbolic nameCOP IDDescriptionType
KLLX_COP_EX1"name" existsUnary operation
KLLX_COP_NEX2"name" not existsUnary operation
KLLX_COP_L3"name" less than "val"Binary operation
KLLX_COP_G4"name" greater than "val"Binary operation
KLLX_COP_LEQ5"name" less or equal than "val"Binary operation
KLLX_COP_GEQ6"name" greater or equal than "val"Binary operation
KLLX_COP_EQ7"name" equal to "val"Binary operation
KLLX_COP_NEQ8"name" not equal to "val"Binary operation
KLLX_COP_CNT9"name" contains "val"Binary operation
KLLX_COP_NCNT10"name" not contains "val"Binary operation

Remarks for binary operations:

  • Value of the "name" attribute from the data source is the first operand and the "val" from the logical expression (or value of "another" attribute from the data source) is the second operand.
  • If the values have different types the operation result is always 'false'.
  • For the KLLX_COP_CNT the first operand must have the type (paramParams) (then the second operand must have the type String) or (paramArray), otherwise the result is always 'false'.
  • If any of values is absent, the operation result is always 'false'.
  • Strings are compared as binary data.

If the "EXPRESSION" contains neither "LOP" nor "OP", the expression is considered to be invalid.

Example of logical expression:

        +---
            +---ARGS
            |   +---0
            |   |   +---OP = KLLX_COP_EQ
            |   |   +---name = "strAttr1"
            |   |   +---val = "val1"
            |   +---1
            |   |   +---OP = KLLX_COP_L
            |   |   +---name = "nAttr2"
            |   |   +---val = 100
            |   +---2
            |       +---ARGS
            |       |   +---0
            |       |   |   +---OP = KLLX_COP_EX
            |       |   |   +---name = "nAttr3"
            |       |   +---1
            |       |       +---OP = KLLX_COP_NEQ
            |       |       +---another = "nAttr5"
            |       |       +---name = "nAttr4"
            |       +---LOP = KLLX_LOP_OR
            +---LOP = KLLX_LOP_AND