Keywords

Usage: with-attribute keyword is used with nested objects(json).

Syntax: property1 with-attribute { property2 = value2}

Example:

GoogleWorkspace GroupSetting should-have entry with-attribute { enableCollaborativeInbox = false }

Usage: with-element keyword is used to specify a hierarchical (or parent-child) relationship between its preceding and succeeding properties, where the parent properties is a list and child property is a member.

Syntax: property1 with-element [ property2 = value2]

Example:

microsoft365 sharingpolicy should-have sharingenabled = false or domains with-element [ sharingalloweddetails = "ContactsSharing"  ]

Usage: with-any-element keyword is used to specify a condition where any of the parent list properties’ members matches the condition following it.

Syntax: property1 with-any-element [ ip = “0.0.0.0” ]

Example:

AzureAD User should-not-have userRegistrationDetails with-attribute {  methodsRegistered with-any-element [ "mobilePhone" ] }

Usage: exists keyword checks the presence of an property.

Syntax: property1 exists

Example:

Okta User should-have profile with-attribute { mobilePhone exists }

Usage: not-exists keyword checks the absence of an property.

Syntax: property1 not-exists

Example:

AzureAD AuthorizationPolicy should-have defaultUserRolePermissions with-attribute { permissionGrantPoliciesAssigned not-exists }

Usage: any keyword is used for a resource type which has a relationship to the resource type mentioned prior to an expression.

as keyword is used for specifying an alias for the resource type whose value can be later used in a conditional statement. Aliases are occasionally required when a value is derived in an earlier part of the rule, and referenced in a later part of the rule. In such conditions, the latter part of the rule refers to the derived value using an alias. It is equivalent to storing a value in a variable. It is used along with any keyword which compares all the available resources assigned by the alias to match the condition. If the condition matches, the true is returned.

Syntax: any resource as a with-attribute {a.attribute1 = “value“}

Example:

servicenow SysProperties should-have any SystemProperty as s with-attribute {s.name = "glide.authenticate.api.user.reset_password.mandatory" and s.value = "true"}

Usage: ### keyword is used to indicate that the subsequent text between two such keywords is a comment string, and will be ignored by the system.

Syntax: ### This is a comment ###

Example:

microsoft365 malwarefilterpolicy should-have len(FileTypes) > 0 ### comment here ###