is_ipv6 - Learn more about the Cortex Query Language is_ipv6() function. - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR 3.x Documentation
Product
Cortex XDR
License
Prevent
Pro
Creation date
2024-03-06
Last date published
2025-12-16
Category
Administrator Guide
Abstract

Learn more about the Cortex Query Language is_ipv6() function.

Syntax
is_ipv6(<IPv6_address>)
Description

The is_ipv6() function accepts a string, and returns true if the string is a valid IPv6 address. The IPv6 address can be either an explicit string using quotes (""), such as "3031:3233:3435:3637:3839:4041:4243:4445", or a string field.

Note

The <IPv6_address> must contain an IPv6 address in an IPv6 field. For production purposes, this IPv6 address will normally be carried in a field that you retrieve from a dataset. For manual usage, assign the IPv6 address to a field, and then use that field with this function.

Example