json_extract_scalar_array - Reference Guide - Cortex XDR - Cortex - Security Operations

json_extract_scalar_array(<json_array_string>, <json_path>)

When a field in the <json_path> contains characters, such as a dot (.) or colon (:), use the syntax:

json_extract_scalar_array(<json_array_string>, "['<json_field>']")

The json_extract_scalar_array() function accepts a string representing a JSON array, and returns an XQL-native array. This function is equivalent to the json_extract_array except that the final output isn't displayed in double quotes ("..."). To convert a string field to a JSON object, use the to_json_string function.

Extract the first IPV4 address found in the first element of the agent_interface_map array. The values of the IPv4 addresses in the array will not contain any double quotes.

dataset = xdr_data 
| fields agent_interface_map as aim 
| alter ipv4 = json_extract_scalar_array(to_json_string(arrayindex(aim, 0)) , "$.ipv4") 
| filter aim != null 
| limit 10

Final output with 1 row from the results table. Notice that the IPV4 column doesn't contain any double quotes (" ") around the IP address 172.16.15.42:

In contrast, compare the above results to the same query using the json_extract_array() function. The final output with the same row from the results table has in the IPV4 column the IP address in double quotes "172.16.15.42".