lowercase - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Documentation

Product
Cortex XSIAM
Creation date
2024-03-06
Last date published
2024-12-12
Category
Administrator Guide
Abstract

Learn more about the Cortex Query Language lowercase() function that converts a string field to all lowercase letters.

Syntax
lowercase (<string>)
Description

The lowercase() function converts a string field value to all lowercase.

Examples

Convert all actor_process_image_name field values that are not null to lowercase, and return a list of unique values.

dataset = xdr_data 
| fields actor_process_image_name as apin 
| dedup apin by asc _time 
| filter apin != null 
| alter apin = lowercase(apin)