Skip to content

Conversation

@tomaskender
Copy link
Contributor

@tomaskender tomaskender commented Sep 15, 2020

Motivation: We want to reuse the value of an evaluated expression multiple times in a rule. This is useful not only for faster evaluation, but also for long definitions that would otherwise have to be copypasted multiple times in conditions and make them longer than they need to be.

Each rule has it's own internal variable scope.
External variables have preference over internal variables (a warning is thrown in such case).

Supported variable types: in theory everything and anything YR_OBJECT supports.
What's implemented: strings, ints, floats, bools

Syntax:

rule abc {
variables:
result= 1+1-1+1

condition:
result > 1 and result < 3
}

@tomaskender tomaskender changed the title Variables Internal variables for rules Sep 15, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant