Policy and Device Filters, and Scheduling

Using Scheduling (POST /policies and PUT /policies/{:id} Endpoints)

Policy schedules are the decimal value of a binary representation of True/False for each day/week/month.

Example Days per Week

For scheduling days of the week there will be 7 digits with a trailing zero to mark the end. This starts on Sunday and ends on Monday. 1 represents ON and 0 represents OFF for each day of the week.

Sun|Sat|Fri|Thu|Wed|Tue|Mon|TrailingZero

Every Day: 11111110 = 254 Mon/Wed/Fri only: 00101010 = 42

Example Weeks per Month

Weeks are scheduled similarly to days, except there are 5 digits with a trailing zero. This starts on the 5th week of the month and ends with the 1st week of the month.

5th|4th|3rd|2nd|1st|TrailingZero

Every Week: 111110 = 62 2nd/4th weeks only: 010100 = 20

Example Months per Year

Months continue the trend with 12 digits with a trailing zero. Starting with December and ending with January.

Dec|Nov|Oct|Sep|Aug|Jul|Jun|May|Apr|Mar|Feb|Jan|TrailingZero

Every Month: 1111111111110 = 8190 Mar/Jun/Sep/Dec = 1001001001000 = 4680

Advanced Filters

The following filter parameters are valid for advanced filters. Anything else will return a 400.

Left Values Condition Values Right Values
display-name contains, does-not-contain text string
severity is, is-not, less-than-or-equal-to, greater-than-or-equal-to other, none, low, medium, high, critical
patch-source is, is-not windowsupdate, opera, mozilla, adobe, oracle, apple, microsoft
patch-os is, is-not windows, mac, linux
type is, is-not upgrades, updates, update-rollups, service-packs, security-updates, tools, guidance, feature-packs, developer-kits, definition-updates, critical-updates, connectors, application
patch-days-old is, is-not, less-than, less-than-or-equal-to, greater-than, greater-than-or-equal-to Integer between 1 and 180

Device Filters - Filter Parameters

The device filters preview allows you to view a preview of devices matching a set of Device Targeting criteria that you define. This correlates to the Device Targeting parameters in the Policy Editor screen available in the UI.

You can then use the same parameters to create a new policy, or update an existing policy, targeting those devices.

See the above sections for more info on Using Scheduling and Advanced Filters.

Field Supported Operators Value Type
os_family in, not_in In, not in: list of strings
os_version_id in, not_in In, not in: list of integers
ip_addr like_any, not_like_any List of strings
tag like_any, not_like_any, in, not_in List of strings
hostname like_any, not_like_any List of strings
organizational_unit like_any, not_like_any, in, not_in List of strings

Operators Used in API vs. Operators Used in UI

Effective 7/22/2022, for improved usability, the operators used for Device Targeting Filters in the UI will be changed. The operators used for Device Targeting Filters in the API have not changed. The table below explains how they correspond to one another:

API Operator UI Operator
in Is
not_in Is Not
like_any Contains
not_like_any Does Not Contain