Kaspersky Security Center Automation  10.0
Host search string syntax.

Host search string (filter string) has syntax resembling one from RFC 2254

	filter	 = "(" filtercomp ")"
	filtercomp = and / or / not / item
	and		= "&" filterlist
	or		 = "|" filterlist
	not		= "!" filter
	filterlist = 1*filter
	item	 = simple
	simple	 = attr filtertype value
	filtertype = equal / greater / less / notequal
	equal	= "="
	greater	= ">"
	less	 = "<"
	notequal   = "<>"
	attr	 = AttributeDescription from List of host attributes and from List of host search-only attributes
	value	= Integer / Quoted string / 'Pseudovalue'


'Quoted string' may contain following wildcards. If 'value' in 'simple' has wildcards then 'filtertype' must be 'equal'

? Any single character.
* Any string of zero or more characters.
[ ] Any single character within the specified range ([a-f]) or set ([abcdef]).
[^] Any single character not within the specified range ([^a-f]) or set ([^abcdef]).


For time comparison 'Pseudovalue' CURTIME([<signed integer delta>]) may be used as "current time (in UTC) + \<signed integer delta\>"

Example:

	(&
		(!KLHST_WKS_PRODUCT_DISPLAY_VERSION = "5*")
		(|
			(KLHST_WKS_GROUPID = 0 )
			(KLHST_WKS_GROUPID = 1 )
		)
		(KLHST_WKS_STATUS_MASK_0 <> 0 )
		(KLHST_WKS_LAST_INFOUDATE > CURTIME(-86400) )
	)