Logical Operations

User-entered logical operations are a key component of Salem's learning architecture and are referred to in the Salem nomenclature as "eval strings." These operations are created by users to inform Salem actions related to context-building workloads, alert categorization, and other logic-based evaluations.

Definition: Eval strings are logical operations used by Salem to add and apply context to alerts based on their details. Salem can be taught to evaluate complex Boolean expressions using the and and or operators and the match() function. These expressions can be used to filter alerts, extract relevant information, and generate new context.

  • == - Equal to operator.

  • != - Not equal to operator.

  • > - Greater than operator.

  • < - Less than operator.

Evaluates to true or False

Returns the length of the object provided

Returns a num rounded to pos digits

Returns the first non null value

If the bool statement evaluates to true, the value of the true case is returned, otherwise the value of the false case is returned

Returns a string comprised of the list values concatenated by the value of str

Returns True or False based on the evaluation of the match expression.

Match types:

  • in <list>: Returns true if the test is contained in the object.

  • is <str>: Returns true if the test is equal to the object.

  • beginsWith <str> : Returns true if the object starts with the test.

  • endsWith <str>: Returns true if the object ends with the test.

  • contains <str>: Returns true if the object contains the test.

  • regex <str>: Returns true if the object matches the test regular expression.

  • bool <str>: Returns true if the test evaluates to true.

  • CIDR <str>: Returns true if the object’s IP address is within the CIDR range specified by the test.

  • eval <func>: Returns true if the test evaluates to True when evaluated in the context of the object.


Returns a date object that is the current UTC time offset by the value of seconds

returns a match value based on the regex exp evaluated over str

returns a list of str components split by the value of exp

# returns: [10,0,0,1]

Accepts a datetime object and a time format string. Returns a str representing time in the format provided

Accepts a time str and format, and returns a datetime object

Accepts a JSON formatted string and returns an object

Accepts and object and returns a JSON formatted string

Accepts an object and returns a str formatted version of that object

Accepts a url quoted string and returns a unquoted version

Accepts a string and returns a url quoted version of that string

Last updated