Creating a Complex Campaign Filter (multiple AND/OR) - Any Examples?

mcheek · May 2, 2024, 1:38pm

I have a use case where I want to filter an uncorrelated account certification campaign this way

Include a specific list of accounts
Include a specific list of entitlements

Basically, there are specific accounts I want to include, but only want to have the reviewer certify some specific entitlements assigned to the included accounts.

I noticed in the create-campaign-filter and update-campaign-filter, there is this line in the specs under the criteriaList.type attribute

This leads me to believe that you can string together some nested query parameters in the children property of each CriteriaList object

{
            "type": "COMPOSITE",
            "property": "attribute.e-mail",
            "value": "chesapeakeadmin",
            "operation": "AND",
            "negateResult": false,
            "shortCircuit": false,
            "recordChildMatches": false,
            "id": "",
            "suppressMatchedItems": false,
            "children": [
                {
                    "type": "ACCOUNT",
                    "property": "attribute.e-mail",
                    "value": "chesapeakeadmin",
                    "operation": "EQUALS",
                    "negateResult": false,
                    "shortCircuit": false,
                    "recordChildMatches": false,
                    "id": null,
                    "suppressMatchedItems": false,
                    "children": null
                },
                {
                    "type": "SOURCE",
                    "property": "application",
                    "value": "OpenInvoice",
                    "operation": "EQUALS",
                    "negateResult": false,
                    "shortCircuit": false,
                    "recordChildMatches": false,
                    "id": null,
                    "suppressMatchedItems": false,
                    "children": null
                }
            ]
        }

Note how each of the “children” has its own “children” property. Has anyone used this? The API specs don’t provide any examples.

colin_mckibben · June 5, 2024, 5:57pm

You can try manually configuring a campaign filter using the composite type and then query it via API to see how it is setup.

mcheek · June 5, 2024, 6:39pm

In the UI? That doesn’t appear to be an option

It looks like it just puts all your filters together in the UI into a single COMPOSITE type with an operation value of AND

mcheek · June 5, 2024, 6:50pm

To add more context to what I was saying before, let’s look at the below filter

What this effectively says is “one of these two users or any user with this entitlement”. There is no way in the UI to add more than one criteria inside a filter, so they all end up being OR operators

What I want it to say is “include these two users but only this entitlement” and there just doesn’t seem to be a way of doing that in the UI.

colin_mckibben · June 6, 2024, 1:31pm

So, if I understand correctly, you want the following filter:

("chesapeakeadmin" and "chesapeake entitlement") or ("chesapeakeonramping" and "chesapeake entitlement")

But right now it only does the or operation…

mcheek · June 6, 2024, 1:44pm

If I were to do it pseudocode style

(account.name:chesapeakeonramping OR account.name:chesapeakeadmin)
AND
(entitlement.name:entitlement_a OR entitlement.name:entitlement_b)

Basically, we have a bunch of uncorrelated accounts we want to filter out, and the two accounts above have other access assigned that isn’t relevant, so we want to limit the review tasks to only the relevant access.

Since this is an uncorrelated account campaign, I can’t utilize a search query to limit the identities and access like I would with a correlated campaign

colin_mckibben · June 6, 2024, 5:42pm

I don’t think the COMPOSITE type is meant to be used in that way, which is why you don’t see support for it in the UI. I think the COMPOSITE is only used when selecting a nested object, like account attribute, which is dependent on a parent object like a source. I tried this out in my tenant and the only time I saw COMPOSITE used is when specifying something like account attribute, which produced this JSON.

{
            "operation": "AND",
            "property": "attribute.id",
            "sourceName": "airtable",
            "type": "COMPOSITE",
            "value": "123123",
            "id": "",
            "children": [
                {
                    "type": "ACCOUNT",
                    "operation": "EQUALS",
                    "property": "attribute.id",
                    "value": "123123"
                },
                {
                    "type": "SOURCE",
                    "operation": "EQUALS",
                    "property": "application",
                    "value": "airtable"
                }
            ]
        }

In this operation, the AND is used to indicate that the children are ANDed together (i.e. filter on attribute.id where the source is airtable AND the attribute.id is 123123.)

I don’t think the COMPOSITE type is meant to be used to AND any operations together.

mcheek · June 6, 2024, 5:59pm

If that’s the case, should the API documentation be updated? Cause this language seems to suggest that you can nest multiple conditions

colin_mckibben · June 6, 2024, 6:32pm

Soooo, I went ahead and gave it a shot, and it seems to work. Well, at least the server accepts my payload. I don’t know if it actually works. Maybe you can take this payload and see if it works on your system. This payload should match the logic of your pseudo code above. You’ll need to change the source name, account name, and entitlement name to match your criteria.

POST /v3/campaign-filters

{
    "name": "Composite Test",
    "description": "Test how a composite operator works",
    "mode": "INCLUSION",
    "criteriaList": [
        {
            "type": "COMPOSITE",
            "operation": "AND",
            "children": [
                {
                    "operation": "OR",
                    "type": "COMPOSITE",
                    "children": [
                        {
                            "operation": "AND",
                            "property": "entitlement.name",
                            "sourceName": "chesapeake",
                            "type": "COMPOSITE",
                            "value": "entitlement_a",
                            "children": [
                                {
                                    "type": "ENTITLEMENT",
                                    "operation": "EQUALS",
                                    "property": "entitlement.name",
                                    "value": "entitlement_a"
                                },
                                {
                                    "type": "SOURCE",
                                    "operation": "EQUALS",
                                    "property": "application",
                                    "value": "chesapeake"
                                }
                            ]
                        },
                        {
                            "operation": "AND",
                            "property": "entitlement.name",
                            "sourceName": "chesapeake",
                            "type": "COMPOSITE",
                            "value": "entitlement_b",
                            "children": [
                                {
                                    "type": "ENTITLEMENT",
                                    "operation": "EQUALS",
                                    "property": "entitlement.name",
                                    "value": "entitlement_b"
                                },
                                {
                                    "type": "SOURCE",
                                    "operation": "EQUALS",
                                    "property": "application",
                                    "value": "chesapeake"
                                }
                            ]
                        }
                    ]
                },
                {
                    "operation": "OR",
                    "type": "COMPOSITE",
                    "children": [
                        {
                            "operation": "AND",
                            "property": "attribute.name",
                            "sourceName": "chesapeake",
                            "type": "COMPOSITE",
                            "value": "chesapeakeonramping",
                            "children": [
                                {
                                    "type": "ACCOUNT",
                                    "operation": "EQUALS",
                                    "property": "attribute.name",
                                    "value": "chesapeakeonramping"
                                },
                                {
                                    "type": "SOURCE",
                                    "operation": "EQUALS",
                                    "property": "application",
                                    "value": "chesapeake"
                                }
                            ]
                        },
                        {
                            "operation": "AND",
                            "property": "attribute.name",
                            "sourceName": "chesapeake",
                            "type": "COMPOSITE",
                            "value": "chesapeakeadmin",
                            "children": [
                                {
                                    "type": "ACCOUNT",
                                    "operation": "EQUALS",
                                    "property": "attribute.name",
                                    "value": "chesapeakeadmin"
                                },
                                {
                                    "type": "SOURCE",
                                    "operation": "EQUALS",
                                    "property": "application",
                                    "value": "chesapeake"
                                }
                            ]
                        }
                    ]
                }
            ]
        }
    ],
    "isSystemFilter": false
}

mcheek · June 6, 2024, 7:19pm

The server accepted some wild payload from me as well, with varying results. I’ll try and see if your format works

system · August 5, 2024, 7:19pm

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Campaign Filter with AND Condition ISC Discussion and Questions identity-security-cloud	6	410	October 9, 2023
Certification Campaign - use Search Query for Uncorrelated accounts ISC Discussion and Questions identity-security-cloud , certifications	2	342	April 8, 2024
Entitlement and Role description in campaign filter ISC Discussion and Questions identity-security-cloud , certifications	5	56	November 22, 2024
Campaign Filters - Deprecation ISC Discussion and Questions identity-security-cloud	14	219	August 27, 2024
Inappropriateness in API response of campaign filters Bugs apis , identity-security-cloud	0	54	June 27, 2024

Creating a Complex Campaign Filter (multiple AND/OR) - Any Examples?

Related topics