object_create - Learn more about the Cortex Query Language object_create() function. - Administrator Guide - Cortex XDR - Cortex - Security Operations

object_create ("<key1>", "<value1>", "<key2>", "<value2>",...)

The object_create() function returns an object based on the given parameters defined for the key and value pairs. Accepts n > 1 even number of parameters.

Returns a final object to a field called a that contains the key and value pair {“2”:“password”}, where the "password" value is comprised by joining 2 values together.

dataset = xdr_data
| alter a = object_create("2", concat("pass", "word"))
| fields a