Skip to main content

count_descendants

Synopsis​

@count_descendants([Expression]) -> Integer

Description​

Counts the number of descendant objects; optionally those matching the provided logical expression.

info

Available in Contextal Platform 1.0 and later.

Parameters​

If no arguments are provided, all descendant objects will be counted. If a logical expression is provided, only descendants matching the expression will be counted.

Return value​

Integer: number of descendant objects (meeting the criteria).

Examples​

@count_descendants() > 10
  • This matches all objects, which have more than 10 descendants.
object_type == 'Email' &&
    @count_descendants(
        object_type == "PE" && @match_object_meta($pe_header.NumberOfSections > 5)
    ) == 1
  • This matches Email objects, which somewhere in their structure contain exactly one PE executable with more than 5 sections.