arrayfilter - Reference Guide - Cortex XSIAM - Cortex

Abstract

Learn more about the Cortex Query Language arrayfilter() function.

Syntax

arrayfilter(<array>, <condition>)

arrayfilter(<array>, "@element"<operator>"<array element>")

Note

The <operator> can be any of the ones supported, such as = and !=.

Description

The arrayfilter() function returns a new array with the elements which meet the given condition. The function does this by filtering the results of an array in one of the following ways:

Returns the results when a certain condition is applied to the array.
Returns the results when a particular array is set to a specified array element.

Though it's possible to define the arrayfilter() function with any condition, the examples below focus on conditions using the @element that are based on the current element being tested.

Basic Example

When the dfe_labels array is not empty, use the Alter stage to assign a value to a field called x that returns the value of the arrayfilter function. The arrayfilter function filters the dfe_labels array for the array element set to network.

dataset = xdr_data 
| filter dfe_labels != null
| alter x = arrayfilter(dfe_labels , "@element" = "network") 
| fields x, dfe_labels 
| limit 100

Advanced Example

This queries below illustrate how to check whether any IPs are included or not included in the blocked list called CIDRS. The Query Results tables are also included to help explain what happens as the arrayfilter() function is slightly modified.

Return Non-Matching CIDRS

This query returns results for each IP that don't match anything in the CIDRS array blocked list:

dataset = xdr_data
| limit 1
| alter cidrs = arraycreate("10.0.0.0/8","172.16.0.0/16"), ip = arraycreate("192.168.1.1", "172.16.20.18")
| fields cidrs, ip
| arrayexpand ip
| alter non_matching_cidrs = arrayfilter(cidrs, ip not incidr "@element")

Results:

The following table details for each IP the logic that is first performed before the final results for the query are displayed:

IP	Statement	TRUE/FALSE
192.168.1.1	not in 10.0.0.0/8	TRUE
192.168.1.1	not in 172.16.0.0/16	TRUE
172.16.20.18	not in 10.0.0.0/8	TRUE
172.16.20.18	not in 172.16.0.0/16	FALSE

For each IP, an array of CIDRS is returned in the NON_MATCHING_CIDRS column, which doesn't match the CIDRS array. In addition, from the above table, arrayfilter() only returns anything that resolves as TRUE. This explains the query results displayed in the following table:

IP	CIDRS	NON_MATCHING_CIDRS
192.168.1.1	10.0.0.0/8,172.16.0.0/16	10.0.0.0/8,172.16.0.0/16
172.16.20.18	10.0.0.0/8,172.16.0.0/16	10.0.0.0/8

Return Matching CIDRS

Now, let's update the query to return results for each IP that match anything in the CIDRS array:

dataset = xdr_data
| limit 1
| alter cidrs = arraycreate("10.0.0.0/8","172.16.0.0/16"), ip = arraycreate("192.168.1.1", "172.16.20.18")
| fields cidrs, ip
| arrayexpand ip
| alter matching_cidrs = arrayfilter(cidrs, ip incidr "@element")