This is what I was working on when coming across this issue: http://bigfix.me/analysis/details/2994801
If an operator doesn’t exist, it throws an error, even if it were never to be evaluated in the first place, or if it is written against a plural object that wouldn’t throw an error on its own.
This should always be TRUE:
Q:TRUE OR exists notAnOperator
E: The operator "notanoperator" is not defined.
This should always be TRUE:
Q:TRUE | exists notAnOperator
E: The operator "notanoperator" is not defined.
It seems like operator non-existence should evaluate to FALSE or NULL, instead of an error, at least in the case of relevance that must be either TRUE or FALSE.
On a Mac:
This works as expected, no error:
Q: registries
T: 41
This should not cause an error, similar to the above, because it is also plural:
Q: x64 registries
E: The operator "x64 registries" is not defined.
This should also not cause an error, because registries returns none, so keys is never evaluated:
Q: keys of registries
E: The operator "keys" is not defined.
This should be FALSE:
Q: exists x64 registry | FALSE
E: The operator "x64 registry" is not defined.
The if (windows of operating system) then (RELEVANCE) else FALSE should not be needed in the following: http://bigfix.me/relevance/details/3002319