Kaspersky Unified Monitoring and Analysis Platform

Requirements for variables

When adding a variable function, you must first specify the name of the function, and then list its parameters in parentheses. Basic mathematical operations (addition, subtraction, multiplication, division) are an exception to this requirement. When these operations are used, parentheses are used to designate the severity of the operations.

Requirements for function names:

• Must be unique within the correlator.
• Must contain from 1 to 128 Unicode characters.
• Must not begin with the character $.
• Must be written in camelCase or CamelCase.

Special considerations when specifying functions of variables:

• The sequence of parameters is important.
• Parameters are separated by a comma: ,.
• String parameters are passed in single quotes: '.
• Event field names and variables are specified without quotation marks.
• When querying a variable as a parameter, add the $ character before its name.
• You do not need to add a space between parameters.
• In all functions in which a variable can be used as parameters, nested functions can be created.