46. Appendix 4 – Attributes & Tokens

The columns from the tables listed below contain the following data:

● Attribute is the left operand used in Response preconditions. In older Wanguard versions the term used was “Conditional Parameter”
● Token is a placeholder that can be used as a parameter or script argument in most Response actions because, at run-time, the software translates it into the requested value. Each token is defined within curly brackets. In older Wanguard versions the term used was “Dynamic Parameter”
● Data Type shows the returned value type and which comparison operators are accepted by the Attribute:
• String returns a variable-length string. It accepts the comparison operators:
▪ equal to - it implies a perfect match without any differences. E.g. if the Attribute is “apple” and the Value is also “apple”, then equal to is true
▪ not equal to - it implies any difference qualifies for this condition to be true. E.g. if the Attribute is “apple” and the Value is “orange”, then not equal to is true
▪ includes - is true if the “Attribute” contains the “Value” as a substring. E.g. if the Attribute is “apple pie” and the Value is “apple”, then includes is true because “apple pie” contains “apple”
▪ included in - is true if the “Value” contains the “Attribute” as a substring. This is the inverse relationship of includes. E.g. if the Attribute is “apple” and the Value is “apple pie”, then included in is true because “apple” is part of the larger string “apple pie”
▪ excludes - is true if the “Attribute” does not contain the “Value” as a substring. This indicates the absence of the “Value” within the “Attribute”. E.g. if the Attribute is “apple pie” and the Value is “cherry”, then excludes is true because “apple pie” does not contain “cherry”
▪ excluded from - is true if the “Value” does not contain the “Attribute” as a substring. This is the opposite of included in. E.g. if the Attribute is “cherry” and the Value is “apple pie”, then excluded from is true because “cherry” is not part of “apple pie”
▪ regexp - is true when the “Attribute” matches the regular expression from “Value”. E.g. when “Value” is “[A-Z]”, the precondition is true only when the “Attribute” contains an upper-case letter
• Integer returns a 64-bit unsigned integer number. It accepts the comparison operators:
▪ equal to - is true when “Attribute” and “Value” are identical
▪ not equal to - is true when “Attribute” and “Value” are not identical
▪ greater than - is true when “Attribute” is larger than “Value”
▪ less than - is true when “Attribute” is smaller than “Value”
▪ divisible by - is true when “Attribute” can be divided by “Value” without leaving a remainder
The “Value” operand may include a multiplier suffix: k (1,000), M (1,000,000), or G (1,000,000,000). E.g. a Value of 2G means 2,000,000,000. The same suffixes are accepted for Float values
• Integer* accepts the same comparison operators as Integer. Appending a suffix to the token name rescales or reformats the returned value:
▪ _kilo - returns the value divided by 1,000
▪ _mega - returns the value divided by 1,000,000
▪ _giga - returns the value divided by 1,000,000,000
▪ _prefix - returns the value followed by the biggest multiplier that fits it (k, M, or G)
▪ _decoder_prefix - like _prefix, but also inserts the decoder before the multiplier
• Float returns an unsigned floating point number when the comparison operator is greater than, less than or not equal to, or an unsigned integer when the comparison operator is equal to or divisible by
• Prefix returns a string containing a subnet or IP. It accepts the comparison operators equal to, not equal to, includes, included in, excludes and excluded from. The inclusion/exclusion operators compare prefixes, not strings
● Description provides a short explanation of the parameter

Note

Tokens are replaced with their run-time values wherever they are used. For example, a Response that emails an alert with the subject {decoder} attack on {prefix} in IP Zone {ipzone} — {anomaly_bps_prefix}bps is delivered as TCP+SYN attack on 192.0.2.10 in IP Zone Customer-A — 4.2 Gbps.

46.6. System-Wide Tokens

Attribute

Token

Data Type

Description

Filters (same Sensor)

{filters_sensor}

Integer

Returns the number of Filter instances activated for an active anomaly detected by the same Sensor.

Anomalies (all Sensors, Decoders, Prefixes)

{anomalies}

Integer

Returns the number of active anomalies regardless of Sensor, Decoder, Unit, or Prefix.

Anomalies (same Sensor)

{anomalies_sensor}

Integer

Returns the number of active anomalies from the same Sensor.

Anomalies (same Decoder)

{anomalies_decoder}

Integer

Returns the number of active anomalies using the same Decoder and Unit (pkts/s or bits/s).

Anomalies (same Sensor, Decoder)

{anomalies_sensor_decoder}

Integer

Returns the number of active anomalies from the same Sensor and using the same Decoder and Unit.

Anomalies (same Sensor, Decoder, Prefix/X)

{anomalies_sensor_decoder_cidr_X}

Integer

Returns the number of active anomalies from the same Sensor, same Decoder and Unit, whose prefix falls within the same /X subnet.

Filtering Rules (all Sensors, Filters, Decoders, Prefixes)

{filtering_rules}

Integer

Returns the number of active filtering rules regardless of Sensor, Filter, Decoder, Unit, or Prefix.

Filtering Rules (same Sensor)

{filtering_rules_sensor}

Integer

Returns the number of active filtering rules from the same Sensor.

Filtering Rules (same Filter)

{filtering_rules_filter}

Integer

Returns the number of active filtering rules from the same Filter.

Filtering Rules (same Decoder)

{filtering_rules_decoder}

Integer

Returns the number of active filtering rules using the same Decoder and Unit (pkts/s or bits/s).

Filtering Rules (same Sensor, Filter, Decoder, Prefix/X)

{filtering_rules_sensor_filter_decoder_cidr_X}

Integer

Returns the number of active filtering rules from the same Sensor and Filter, same Decoder and Unit, whose prefix falls within the same /X subnet.