Refine your data with Business Logic

Organizations often collect vast amounts of data from controls, assets, and systems. This data can be overwhelming and hard to act on without structure or context. 

Panaseer’s Business Logic solves this by applying rules that group and rename information into the context that matters most to your business. It removes noise, highlights real risks, and translates raw data into clear, actionable insights.

An example Business Logic attribute

Business Logic (BL) helps to make Continuous Controls Monitoring (CCM) dynamic, contextual, and business-aware, ensuring you spend less time interpreting dashboards and more time making informed decisions.

Key benefits

• Easily defined: Panaseer includes an SQL-like control builder to quickly define custom logic in the context of your business.
• Real-time preview: BL construction updates in real-time so you can see a preview of how effective your rules are and iterate quickly to achieve the best result.
• OOTB examples: Panaseer includes over 50 ready-made BL attributes to get you started.

Accessing Business Logic functions

All stages of the Panaseer data pipeline are controlled by the Data Management Center (DMC), including Business Logic. 

To access BL in Panaseer, click the DMC icon in the left-hand menubar and then select Business logic.

Accessing BL from the DMC

The Business Logic page is displayed.

The default BL page

This page allows you to search through some example logic attributes created by Panaseer or add your own using the New attribute button.

You can also see if BL is influencing a particular metric by clicking the button on the selected metric and selecting Business Logic.

More information on the BL affecting this metric is displayed.

If the Business Logic option is not available in the menu, then no BL attributes apply to the selected metric.

Using example logic

Panaseer includes over 50 ready-made BL attributes to get you started. They’re split into groups by inventory, such as Account, Device, and People. 

If the example attributes don’t suit your needs, you can create your own attributes from scratch. Refer to Creating your own logic for more details.

Each group contains example BL attributes that are disabled by default. Select an attribute to display its Classification logic and an Explanation of how the attribute works.

For example, the Device inventory contains a Device Subtype attribute.

The OOTB Device Subtype logic attribute

This logic attribute is designed to group devices by type using the os_type column. It uses rlike statements to define the device type based on the OS it’s running. Let’s take the first line as an example:

when ds_panaseer_context_device.os_type rlike "(?i)(Windows Vista)|(Windows XP)|(Windows 7)|(Windows 8)|(Windows 10)|(Windows 11)|(Windows 12)|(Windows 1.0)|(Windows 13)|(OSX)|((os x\D+)+(\d+))" then "Desktop/Laptop"

This logic states that any device running various flavors of Windows or macOS is labeled as Desktop/Laptop. Layering up rlike statements adds a business-aware layer to filtering in Panaseer, giving you greater control over what dashboards display.

In this example, enabling the Device Subtype logic attribute allows you to filter metrics, dashboards, and inventories using the device_subtype dimension.

Filtering using a BL attribute

Creating your own logic

If the example attributes don’t suit your needs, you can create your own attributes from scratch by clicking the New attribute button in the relevant inventory. A valid logic attribute requires the following components:

• Column name
• Display name
• Description
• Type
• Explanation
• Classification Logic

Refer to Why doesn’t my Business Logic work? for more information on attribute restrictions.

You can't change the data type after a BL attribute has run through the pipeline and you can't delete BL attributes, so take care when implementing logic.
If you need to stop an attribute contributing to the pipeline, you can switch the button to off.

If you're unsure of the Column name to use, click the Show data explorer button to examine the available datasets and search for the relevant column.

The data explorer displays all the available datasets for the selected inventory and the columns within each dataset. For example, the image shows the Panaseer Context Device dataset and a schema containing the available column names, such as dataset_record_id and entity_id.

Finding a Column name using the data explorer

Adding Classification Logic

Classification logic determines how an attribute classifies your data and applies the rules that group and rename information into the context that matters most to your business.

For example, you could create a PII Status (Personally Identifiable Information) attribute in the Device inventory containing the following logic:

when lower(ds_service_now_device.dv_u_compliance_types) like "%personal data%" then "In Scope" 
else "Out of Scope"

This logic converts the contents of the dv_u_compliance_types column to lowercase and then checks if the output value contains the phrase "personal data". It then returns In Scope or Out of Scope, depending on the results.

An example PII Status logic attribute

You could use this attribute to mark devices as In Scope for compliance classification when dealing with regulations that require clear identification of records involving personal data, such as GDPR.

To help you create logic attributes, Panaseer validates your SQL in real-time and displays a warning if it’s invalid. 

Panaseer's built-in SQL syntax checker

New and edited attributes won't take effect until the end of your organization's next scheduled pipeline run.

Previewing the effect of BL attributes

Panaseer’s BL attribute Breakdown preview lets you instantly see how changes to your logic attributes, such as groupings or classifications, affect your data without waiting for the next pipeline run. This makes it easy to test and refine statements in real time, helping you validate that your logic produces the expected filters before promoting changes.

For example, you could create an attribute with the following statement to label devices from the jamf security tool by OS.

case
  when ds_jamf_device.operatingsystem_name is not null then ds_jamf_device.operatingsystem_name
  else 'To be classified'
end

The Breakdown labels all devices with an entry in the operatingsystem_name field with some flavor of macOS.

If you then added another statement to label devices from the Carbon Black security tool by OS, like:

case
   when ds_jamf_device.operatingsystem_name is not null then ds_jamf_device.operatingsystem_name
   when ds_carbon_black_device.devices_os is not null then ds_carbon_black_device.devices_os
   else 'To be classified'
end

The Breakdown updates automatically to label all devices with an entry in the operatingsystem_name field from both security tools, reducing the number of To be classified entries significantly.

The Breakdown preview lets you see the impact of your logic changes instantly, without waiting around for the pipeline. It’s a fast, flexible way to test and refine your Business Logic with confidence.

You can switch to the Data table tab to view the preview in table form.

Why doesn’t my Business Logic work?

Business Logic is an incredibly powerful tool, but as in all things, power should be used responsibly. Here are a few examples of reasons why your BL attributes may not work as expected.

• Mismatched data types: The SQL-like Classification logic section might pass a logic attribute based on syntax, but running the BL attribute on an inventory will fail if any of the results are not in the expected data type you specified in the new attribute’s Type field.
• Conflicting identifiers: BL attributes with the same column_name as an identifier, such as host or email, can be created but running the BL attribute will fail because the identifiers already exist in the destination table.
• Duplicate columns: Columns for each attribute across all the inventories must be unique. Display names can be used more than once.
  As a workaround, BU in the Application and Device inventories could be app_bu and device_bu respectively to avoid clashes in names.

As always, if you’re unsure or need guidance, please contact your CSM for help.