SRL Language Basics

Execution, statements, values, operators, loops, and control flow used by every SRL audit rule.

Execution model

Rule Manager metadata establishes the scope before SRL starts. SRL then evaluates the selected device or VDOM configuration and emits zero or more findings.

SettingEffect
Run Rule: device_onceRuns once with device/global context.
Run Rule: per_vdomRuns once for every selected VDOM.
Loop Mode: singlethis is the selected section or root scope.
Loop Mode: per_editRuns once per visible edit entry; this is that entry.

Statements and values

// Comments use // or /* ... */
let $minimum = 12;
$status = lower(this.status);
$enabled = true;
$message = "Minimum length: " + string($minimum);

if ($status equals "enable") {
    addPassFinding();
}
  • Strings may use single quotes, double quotes, or backticks.
  • Numbers support integers and decimals. Booleans are true and false.
  • let $name = value and $name = value are equivalent declarations.
  • += adds numbers when both values are numeric; otherwise it concatenates text.
  • ++, --, and -= operate on writable numeric variables.
  • SRL does not provide a general-purpose null value; it is accepted only by documented optional finding arguments.

Operators

GroupOperatorsNotes
Equalityequals, ==, is, !=, is notText comparison is case-insensitive.
Membershipcontains, not contains, inWorks with text and lists; interpreter 2 flattens nested values.
Presenceexists, not exists, empty, not emptyUnresolved paths behave as missing.
Patternmatches_regex, not matches_regexAccepts a pattern with or without delimiters.
Numeric>, >=, <, <=Operands are converted using SRL numeric rules.
Booleanand, &&, or, ||, not, !Parentheses make mixed conditions clearer.

Control flow

foreach ($service in this.service) {
    if ($service equals "TELNET") {
        addFailFinding("TELNET is allowed.", "Replace TELNET with an encrypted service.");
        break;
    }
    if ($service equals "PING") {
        continue;
    }
}

return;

Supported blocks are if, else if/elseif, else, and foreach. Supported flow statements are break, continue, and return. Inside foreach, both the loop variable and this refer to the current item.