Kaspersky Security Center Automation
10.0
|
Host search string (filter string) has syntax resembling one
from RFC 2254
filter = "(" filtercomp ")" filtercomp = and / or / not / item and = "&" filterlist or = "|" filterlist not = "!" filter filterlist = 1*filter item = simple simple = attr filtertype value filtertype = equal / greater / less / notequal equal = "=" greater = ">" less = "<" notequal = "<>" attr = AttributeDescription from List of host attributes and from List of host search-only attributes value = Integer / Quoted string / 'Pseudovalue'
'Quoted string' may contain following wildcards. If 'value' in
'simple' has wildcards then 'filtertype' must be 'equal'
? | Any single character. |
* | Any string of zero or more characters. |
[ ] | Any single character within the specified range ([a-f]) or set ([abcdef]). |
[^] | Any single character not within the specified range ([^a-f]) or set ([^abcdef]). |
For time comparison 'Pseudovalue' CURTIME([<signed integer
delta>]) may be used as "current time (in UTC) + \<signed
integer delta\>"
Example:
(& (!KLHST_WKS_PRODUCT_DISPLAY_VERSION = "5*") (| (KLHST_WKS_GROUPID = 0 ) (KLHST_WKS_GROUPID = 1 ) ) (KLHST_WKS_STATUS_MASK_0 <> 0 ) (KLHST_WKS_LAST_INFOUDATE > CURTIME(-86400) ) )