Set dynamic group syntax

This page outlines how you can set custom membership rules for dynamic groups using the Knox Manage Expression Language (EL). For more information on creating dynamic groups, see Register a group.

How the Knox Manage Expression Language (EL) works

The Knox Manage EL is based on the MVFLEX Expression Language (MVEL) and uses a subset of its functionalities. While many functionalities are supported, the following functionalities offered by MVEL aren’t supported in the Knox Manage EL:

• For Loop
• Do While, Do Until
• While, Until

With the Knox Manage EL, you create group rules by setting the syntax of one or more expressions. Expressions can reference, transform, and combine attributes. For example, you can use a custom expression to remove @company.com from an email address, or combine the firstName and lastName attributes into a single name.

The syntax of each expression combines the following fields: object, attribute, operator, and value.

• Object — Defines whether you’re creating a rule for a user group or a device group.
• Attribute — Sets the attribute you want to define groups by, such as User ID or Device Name. Attributes differ for user groups and device groups. See the bottom of the page for a list of supported attributes.
• Operator — Defines the comparison operator between the attribute and the value, such as equals or greater than. See the table below for a list of supported operators for rules with a single expression.
• Value — Determines the possible configurations for each attribute. For example, if you set a rule where the attribute is Lock Status, the values are Locked or Unlocked.

Supported operators

The table below lists all of the supported operators and their syntax for rules with a single expression.

Rules with a single expression

A single expression is the simplest type of membership rule. You can use single expressions when you want to create a rule that references a single attribute and operator.

Below is an example of a single expression rule which groups users in the sales department:

The total body of your rule can’t exceed 1,000 characters.

Rules with multiple expressions

You can use multiple expressions when you want to create a rule that references multiple attributes and operators. To combine multiple expressions, enclose each expression with parentheses and use the && or || operators between them. There is no limit to the number of expressions you can string together.

Below is an example of a rule with multiple expressions which groups devices that are enrolled through KME or Android devices:

Additionally, to compare the value of an attribute against multiple values, you can use the In and Not in operators. Use [ ] to begin and end the list of values.

Below is an example of an expression using the In operator to groups users with specific tags.

The total body of your rule can’t exceed 1,000 characters

Create a rule for all users

You can create a group that contains all users within a tenant. When users are added or removed from the tenant in the future, the group’s membership adjusts automatically.

To construct a rule for all users, use a single expression with the Is not blank operator.

Create a rule for all devices

You can create a group that contains all devices within a tenant. When devices are added or removed from the tenant in the future, the group’s membership is adjusted automatically.

To construct a rule for all devices, use a single expression with the Is not blank operator.

Supported user attributes

You can use three types of attributes to construct a membership rule for user groups:

• Date
• String
• String collection

See the tables below for a list of supported attributes.

Date

String

String collection

Supported device attributes

You can use three types of attributes to construct a membership rule for device groups:

• Date
• String
• String collection
• Security
• Network
• Security Detail

See the tables below for a list of supported attributes.

Date

String

String collection

Security

Security details

Network