is_known_private_ipv6 - Learn more about the Cortex Query Language is_known_private_ipv6() function. - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR 3.x Documentation
Product
Cortex XDR
License
Prevent
Pro
Creation date
2024-03-06
Last date published
2026-02-10
Category
Administrator Guide
Abstract

Learn more about the Cortex Query Language is_known_private_ipv6() function.

Syntax
is_known_private_ipv6(<IPv6_address>)
Description

The is_known_private_ipv6() function accepts an IPv6 address, and returns true if the IPv6 string address belongs to any of the following known set of private network IPs:

  • FC00::/7

  • FD00::/7

The IPv6 address can be either an explicit string using quotes (""), such as "3031:3233:3435:3637:3839:4041:4243:4445", or a string field.

Note

The <IPv6_address> must contain an IPv6 address in an IPv6 field. For production purposes, this IPv6 address will normally be carried in a field that you retrieve from a dataset. For manual usage, assign the IPv6 address to a field, and then use that field with this function.

Example