Skip to main content

Math Operators

Math operators can enhance the ability to perform arithmetic calculations within a query. These operators are used in conjunction with the RETURN keyword to compute values based on numeric attributes in the target data model. Math operators always return numeric values and not the individual records themselves.

Important

You can only use math operators in reports. The RETURN statement is overwritten in both Explorer and different list pages. You will only see results if used in reports.

When using math operators:

  • You must use them inside a RETURN or WITH clause.
  • Parentheses are recommended to control the order of evaluation.
  • Do not reuse aliases created from math expressions as inputs to other math expressions.
  • Math expressions cannot be used inside WHERE clauses.

Addition​

Use + or ADD to add a value to a numeric attribute.

FIND Vulnerability AS v
RETURN DISTINCT (v.ageInDays + 4) AS "Age in days"
LIMIT 100

The above query returns the calculated age-in-days for vulnerabilities, increased by 4.

Subtraction​

Use - or SUB to subtract a value from a numeric attribute.

FIND Host AS h
RETURN DISTINCT (h.riskScore - 2) AS "Risk score"
LIMIT 100

The above query returns the risk score for hosts after subtracting 2.

Multiplication​

Use * or MULT to multiply a numeric attribute by a value.

FIND Asset AS a
RETURN DISTINCT (a.baseRiskScore * 2) AS "Doubled risk"
LIMIT 100

The above query returns each asset's base risk score multiplied by 2.

Division​

Use / or DIV to divide a numeric attribute by a value.

FIND Finding AS f
RETURN DISTINCT ((f.ageInDays + 10) / 5) AS "Adjusted age"
LIMIT 100

The above query adds 10 the ageInDays value and then divides the result by 5.

Aliases and math operators​

Aliases created as a result of math operations should not be reused in subsequent math expressions within the same query. Consider the following query:

FIND Vulnerability AS v
WITH (v.riskScore * 2) AS doubledScore
RETURN (doubledScore + 1) AS finalScore

In the above query, doubledScore is an alias created for the result of the math operation (v.riskScore * 2). However, this alias is then used in a subsequent math operation (doubledScore + 1). This usage is invalid because it involves using an alias from a math operation in another, leading to errors.

The correct approach is to perform all the math operations directly within a single expression, like so:

FIND Vulnerability AS v
RETURN ((v.riskScore * 2) + 1) as finalScore

Here, the entire math operation ((v.riskScore * 2) + 1) is calculated in one step, and the result is then assigned to an alias finalScore. This avoids the usage of an intermediate alias, ensuring the query adheres to the proper syntax.

Multiple math operators​

You can use multiple math operators and parentheses for complex calculations. For example, take the following query:

FIND Vulnerability AS v
RETURN DISTINCT (v.ageInDays + 4) - (4 / 3 * 1) AS "Age in days"
LIMIT 100

The above query calculates the age of vulnerabilities in days. It first adds 4 days to the ageInDays value of each vulnerability, then subtracts the result of a separate calculation (4 divided by 3, then multiplied by 1). The final Age in days is returned for each distinct vulnerability, limiting to the first 100 results.

Last updated on