The following are the expressions used in NGL:
should-have
Usage: should-have is used to match the condition against the resource type.
Syntax: <app suite> <resource type> should-have <condition>
Example:
microsoft365 remotedomain should-have autoforwardenabled = false
Explanation: the NGL rule will filter the Microsoft365 resources that have remotedomain resource type where autoforwardenable property is false.
should-not-have
Usage: should-not-have is used to not match the condition against the resource type.
Syntax: <app suite> <resource type> should-not-have <condition>
Example:
microsoft365 remotedomain should-not-have autoforwardenabled = false
Explanation: the NGL rule will filter the Microsoft365 resources that have remotedomain resource type but autoforwardenable property is not false.
Conditional Scoping
where
Usage: where is used for filtering resources using resource properties, ensuring only the relevant subset of resources is considered during evaluations. Multiple conditions can be combined in the where expression using logical operators (and, or) to form complex filters. See How to Optimize NGL Queries with Resource Filtering? article for more details on when and how to use scoping.
Syntax: <app suite> <resource type> should-have/should-not-have <condition> where <scoped condition>
Example:
Workday WorkdayAccount should-have age(nskp_LastPasswordChangeDate, "days") < 180 where textmatch(username, "-external$") = true
Explanation: NGL will evaluate all Workday users with username ending with ‘-external’ and check if the password was last changed in the 180 days. In absence of the where expression, all the Workday users will be evaluated.
should-have/should-not-have expressions impact the condition evaluation, while scoping conditions filter its scope.Common Errors
This section outlines errors that may occur with where.
| Error Scenario | Incorrect NGL Example | Sample Error Message | Steps to fix the error |
|---|---|---|---|
| Scoped secondary resource is missing evaluation condition | servicenow SysProperties should-have 1 = 1 where SystemProperty with-attribute { name = "my.prop.name" } | Error: secondary resource 'SystemProperty' that has scoping condition(s), should have at least 1 condition in the should-have clause | Add evaluation condition(s) for the scoped secondary resource. |