is_ipv4 - Learn more about the Cortex Query Language is_ipv4() function. - Administrator Guide - Cortex XDR - Cortex - Security Operations

The example provided is based on the following data table for a dataset called ips_test_raw:

dataset = ips_test_raw
| alter IsIpv4 = is_ipv4(ip)
| filter IsIpv4

Returns all the IPv4 addresses from the ip field in the ips_test_raw dataset. When the is_ipv4 function returns true, the results are displayed with a new IsIpv4 column (field) indicating a true value. If the function returns false, no results are returned.