uppercase - Reference Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR XQL Language Reference

Product
Cortex XDR
Creation date
2024-07-16
Last date published
2024-10-06
Category
Reference Guide
Abstract

Learn more about the Cortex Query Language uppercase() function that converts a string field to all uppercase letters.

Syntax

uppercase (<string>)

Description

The uppercase() function converts a string field value to all uppercase.

Examples

Convert all actor_process_image_name field values that are not null to uppercase, and return a list of unique values.

dataset = xdr_data 
| fields actor_process_image_name as apin 
| dedup apin by asc _time 
| filter apin != null 
| alter apin = uppercase(apin)