Skip to main content

has_root

Synopsis​

@has_root(Expression) -> Boolean

Description​

Checks if the object has a root object matching the provided logical expression. The root object is the first one in the tree, from which other objects were eventually extracted. This function is similar to @has_ancestor(), but is limited only to the root object.

info

Available in Contextal Platform 1.0 and later.

Parameters​

A logical expression, which should match for the root object.

Return value​

Boolean: true if the root object satisfies the logical expression, false otherwise.

Examples​

object_type = "CAB" && @has_root(object_type == "CDFS" && size < 2097152)
  • This matches a CAB object, that is found somewhere inside a CDFS object, which is a root object (i.e. the CDFS object (likely an .iso file) was submitted to the platform for analysis) and it's smaller than 2 MB.