CEL examples

Access usernames from a detection.

${alertUsernames(inputs)}

Access hostnames from a detection.

${alertHostnames(inputs)}

Access source IP addresses from a detection.

${alertSourceIPs(inputs)}

Access destination IP addresses from a detection.

${alertDestinationIPs(inputs)}

Return the detection timestamp in human-readable format.

${string(alertCreatedAtSeconds(inputs)).toTimestamp()}

Return true if detection contains a specific related entity value.

This example returns a value of true if the detection contains a specified sensorId value:

${'sensorId:1234redacted5678' in alertEntities(inputs)}

Create a default error message.

${!has(status.code) || status.code != 201 ? (has(body.errorMessages) ? body.errorMessages[0] : 'Unknown error returned by Vendor API') : ''}

Access the target username from the source event of a detection.

This example accesses TargetUserName from the source_event of a detection:

${alertEntities(inputs).filter(e, e.startsWith('targetUserName'))}

Match a case assigned to the tenant.

investigationAssigneeId(inputs) == '@customer'

Negate a property on a detection.

Note that you must wrap the part you are negating in parentheses. Use .lowerAscii() to lower case the title.

!(alertTitle(inputs).lowerAscii().contains('this is a test'))

Map the case priority to a string.

${investigationPriority(inputs)}