case_sensitive - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

config case_sensitive = true | false

The case_sensitive configuration identifies whether field values are evaluated as case sensitive or case insensitive. The config case_sensitive stage must be added at the beginning of the query. You can also add another config case_sensitive stage when adding a join or union stage to a query.

If you do not provide this stage in your query, the default behavior is false, and case is not considered when evaluating field values.

config case_sensitive = true 
| dataset = xdr_data 
| fields actor_process_image_name as apin 
| filter apin != NULL and apin contains "python" 
| limit 100