case_sensitive - Administrator Guide - Cortex XSIAM - Cortex

case_sensitive - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Documentation

Product

Cortex XSIAM

Creation date

2024-03-06

Last date published

2025-01-16

Syntax

config case_sensitive = true | false

Description

The case_sensitive configuration identifies whether field values are evaluated as case sensitive or case insensitive. The config case_sensitive stage must be added at the beginning of the query. You can also add another config case_sensitive stage when adding a join or union stage to a query.

If you do not provide this stage in your query, the default behavior is false, and case is not considered when evaluating field values.

The Settings → Configurations → XQL Configuration → Case Sensitivity (case_sensitive) setting can overwrite this case_sensitive configuration for all fields in the application, except for BIOCs, which will remain case insensitive no matter what this setting is set to.

The config case_sensitive stage can't be used to compare a field to an inner query. In this situation, ensure to use the lowercase or uppercase functions on the field and inner query stages and functions syntax.

Example 145.

This query won't provide the correct results of comparing the agent_hostname field with the inner query:

config case_sensitive = false 
| dataset = xdr_data 
| fields agent_hostname
| filter agent_hostname in (dataset = <lookup dataset> | fields agent_hostname)

This query will provide the correct output:

config case_sensitive = false  
| dataset = xdr_data
| fields agent_hostname 
| filter lowercase(agent_hostname) in (dataset = <lookup dataset> | alter lower_agent_hostname = lowercase(agent_hostname) | fields lower_agent_hostname)

The config case_sensitive stage can't be used to compare a field to an array that contains non-literal strings, for example a field name or function.
Example 146.
The results of this example are true, where the left side (uppercase("a")) is lowercase as it's not an array, and the right side (("x", "A")) is also an array that contains only literal strings.
```
| alter field_name = if(uppercase("a") in ("x", "A"), true, false)
```
Example 147.
The results of this example are false, where the left side (uppercase("a")) is lowercase as it's not an array, and the right side ("x", uppercase("a"))) is an array that contains a function (uppercase("a")).
```
| alter field_name = if(uppercase("a") in ("x", uppercase("a")),true, false)
```

Examples

config case_sensitive = true 
| dataset = xdr_data 
| fields actor_process_image_name as apin 
| filter apin != NULL and apin contains "python" 
| limit 100