Handling of include filters

[johnulmer-oval]

Regarding the processing of filters, we have come upon a question about how multiple 'include' filters should work.

Given an array of 100 OVAL items that have been collected for a given OVAL object.
And, two 'include' filters.

The first filter is applied to the array of 100 and 30 pass the state check and are put in the results set (array "B").
When the 2nd filter is applied, should it be applied to the original array of 100, OR, is it applied to what is the current result set in array "B"?

If the 2nd filter is applied to the original array of 100 items, then it would be possible to add (include) items into the results set that would conflict with the 1st filter. This might be resolved with a filter operator ('AND' or 'OR'), or something to that effect?

Conversely, if the 2nd filter is applied to the results of the 1st filter (the 30 items in array "B"), then the two filter would be compounding, so to speak. Any item left in the results set after the 2nd filter is applied will have met the requirements of both filters.

Thoughts?

[wmunyan]

From what I can recall from back in the day, the CIS tool would "compound" the filters, per your statement of: Conversely, if the 2nd filter is applied to the results of the 1st filter

(the 30 items in array "B"), then the two filter would be compounding, so to speak. Any item left in the results set after the 2nd filter is applied will have met the requirements of both filters.

That's not necessarily an answer as to which method is correct, just what the CIS tool did/does :) Cheers, -Bill M.

…

On Wed, May 28, 2025 at 1:54 PM John Ulmer ***@***.***> wrote: Regarding the processing of filters, we have come upon a question about how multiple 'include' filters should work. Given an array of 100 OVAL items that have been collected for a given OVAL object. And, two 'include' filters. The first filter is applied to the array of 100 and 30 pass the state check and are put in the results set (array "B"). When the 2nd filter is applied, should it be applied to the original array of 100, OR, is it applied to what is the current result set in array "B"? If the 2nd filter is applied to the original array of 100 items, then it would be possible to add (include) items into the results set that would conflict with the 1st filter. This might be resolved with a filter operator ('AND' or 'OR'), or something to that effect? Conversely, if the 2nd filter is applied to the results of the 1st filter (the 30 items in array "B"), then the two filter would be compounding, so to speak. Any item left in the results set after the 2nd filter is applied will have met the requirements of both filters. Thoughts? — Reply to this email directly, view it on GitHub <#272>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AB7K53H6O6RIZL6LGIWDL2T3AXZ3RAVCNFSM6AAAAAB6DPYYIKVHI2DSMVQWIX3LMV43ERDJONRXK43TNFXW4OZYGM4DKNZVGM> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>