Skip to main content

has_sibling

Synopsis

@has_sibling(Expression) -> Boolean

Description

Checks if the object has a sibling (another object of the same parent) matching the provided logical expression.

info

Available in Contextal Platform 1.0 and later.

Parameters

A logical expression, which should match for the sibling object.

Return value

Boolean: true if there exists a sibling object matching the logical expression, false otherwise.

Examples

object_type = "LNK" && @has_sibling(object_type == "PE")
  • This matches a LNK object, which has a sibling in form of a PE object (such as exe or dll).