Common Expression Language (CEL) overview
Sophos XDR's automations platform is compatible with Google's Common Expression Language (CEL). You can use CEL to add logic and manipulate data in connectors and playbook templates.
The following resources help you get started using CEL in Sophos XDR:
- For introductory information about CEL components, see Get started with CEL.
- For examples of CEL use in Sophos XDR, see CEL examples.
- For examples of common CEL macros used in Sophos XDR, see Common supported CEL macros.
- For details on using the Sophos XDR tool to test CEL expressions against a specific input, see CEL Explorer.
Syntax
The following sections show how to use CEL expressions in different areas of Sophos XDR.
Connectors
In a connector, the CEL expression must be wrapped in ${}. For example:
${inputs.myvar}
Playbook templates
In a template, you can wrap the CEL expression in ${}, but it doesn't have to be. For example, the following two statements do the same thing:
${inputs.myvar}
inputs.myvar
Note
In a template, text enclosed in single quotes remains unchanged and isn't evaluated as CEL.
For example, in:
"inputs.myvar 'preserve text' inputs.newvar"
inputs.myvar and inputs.newvar are evaluated, but 'preserve text' remains unchanged.
Playbook inputs and trigger filters
You must use the ${} notation when using a CEL expression as an input to a playbook or in trigger filter criteria.