if - Learn more about the Cortex Query Language if() function that returns a result after evaluating a condition. - Administrator Guide - Cortex XSIAM - Cortex

if - Learn more about the Cortex Query Language if() function that returns a result after evaluating a condition. - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Documentation

Product

Cortex XSIAM

Creation date

2024-03-06

Last date published

2025-11-09

Syntax

if (<boolean expression>, <true return expression>[, <false return expression>])

if(<boolean expression1>, <true return expression1>, <boolean expression2>, <true return expression2>[, <boolean expression3>, <true return expression3>,...][, <false return expression>])

```
if(<boolean expression1>, if(<boolean expression2>, <true return expression2> [,<false return expression2>])...[,<false return expression1>])
```
Note
In the above syntax, if(<boolean expression2>, <true return expression2> [,<false return expression2>]) represents the <true return expression1>.

Description

The if() function evaluates a single expression or group of expressions depending on the syntax used to define the function. The syntax can be set up in the following ways:

Regular if statement: A single boolean expression is evaluated. If the expression evaluates as true, the function returns the results defined in the second function argument. If the expression evaluates as false and a false return expression is defined, the function returns the results of the third function argument; otherwise, if no false return expression is set, returns null.
Nested if/else statment: At least two boolean expressions and two true return expressions are required when using this option. The first boolean expression is evaluated. If the first expression evaluates as true, the function returns the results defined in the second function argument. The second boolean expression is evaluated. If the second expression evaluates as true, the function returns the results defined in the fourth function argument. If there are any other boolean expressions defined, they are evaluated following the same pattern when evaluated as true. If any of the expressions evaluates as false and a false return expression is defined, the function returns the results defined in the last function argument for the false return expression; otherwise, if no false return expression is set, returns null.

Examples

If '.exe' is present on the action_process_image_name field value, replace that substring with an empty string. This example uses the replace and lowercase functions, as well as the contains operator to perform the conditional check. When the '.exe' is not present, the value is returned as is.replacelowercaseSupported Operators

dataset = xdr_data 
| fields action_process_image_name as apin 
| filter apin != null 
| alter remove_exe_process = 
    if(lowercase(apin) contains ".exe",  // boolean expression
       replace(lowercase(apin),".exe",""), // return if true
       lowercase(apin))  // return if false
| limit 10

Return a maximum of 1 xdr_data record from the past 7 days. The table results include a new column called check_ip, which evaluates and returns the following:

If the action_local_ip contains an IP address that begins with 10, return Local 10.
If the action_local_ip contains an IP address that begins with 172, return Local 172 ?.
If the action_local_ip contains an IP address that begins with 192.168, return Local 192.
If all the above expressions evaluate as false, return null.

config timeframe = 7d | dataset = xdr_data 
| limit 1
| alter 
    check_ip = if(action_local_ip ~= "^10",//boolean expression1
               "Local 10", // true return expression1
               action_local_ip ~= "^172", //boolean expression2
               "Local 172 ?", //true return expression2
               action_local_ip ~= "^192\.168", //boolean expression3
               "Local 192") //true return expression3

Syntax

Note

Description

Examples