Cortex Query Language supports specific comparison, boolean, and set operators in Cortex XSIAM.
Cortex Query Language (XQL) queries support the following comparison, boolean, string, range, and add operators.
Operator | Description |
---|---|
Comparison operators | |
=, != | Equal, Not equal |
<, <= | Less than, Less than or equal to |
>, >= | Greater than, Greater than or equal to |
Boolean operators | |
and | Boolean and |
or | Boolean or |
not | Boolean not |
String and range operators | |
IN, NOT IN | Returns true if the integer or string field value is one of the options specified. For example: action_local_port in(5900,5999) For string field values, wildcards are supported. In this example a wildcard ( str_field in ("*word_1*", "*word_2*", "word") |
CONTAINS, NOT CONTAINS | Performs a search for an integer or string. Returns true if the specified string is contained in the field. Example 107. lowercase(actor_process_image_name) contains "psexec" |
~= | Matches a regular expression. Example 108. action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe" |
INCIDR, NOT INCIDR | Performs a search for an IPv4 address or IPv4 range using CIDR notation, and returns true if the address is in range. Example 109. action_remote_ip incidr "192.1.1.1/24" It is also possible to define multiple CIDRs with comma separated syntax when building a XQL query with the Query Builder or in Correlation Rules. When defining multiple CIDRs, the logical Example 110. action_remote_ip incidr "192.168.0.0/24, 1.168.0.0/24" Both the IPv4 address and CIDR ranges can be either an explicit string using quotes ( |
INCIDR6, NOT INCIDR6 | Performs a search for an IPv6 address or IPv6 range using CIDR notation, and returns true if the address is in range. Example 111. action_remote_ip incidr6 “3031:3233:3435:3637:0000:0000:0000:0000/64” It is also possible to define multiple CIDRs with comma separated syntax when building a XQL query with the Query Builder or in Correlation Rules. When defining multiple CIDRs, the logical Example 112. action_remote_ip incidr6 "2001:0db8:85a3:0000:0000:8a2e:0000:0000/64, fe80::/10" Both the IPv6 address and CIDR ranges can be either an explicit string using quotes ( |
Add operator for tagging | |
add | The Example 113.
|