Supported CEL macros

Sophos XDR supports Google's CEL macros for evaluating and manipulating data. Some macros are built in, while others are specific to Sophos XDR. This page describes commonly used macros.

You can also use CEL Explorer, which provides context-aware autocomplete for CEL macros. For details, see CEL Explorer.

In these examples, the following data structure is used:

{
    "plant": {
        "type": "tree",
        "name": "white oak",
        "uses": [
            "lumber",
            "firewood",
            "furniture"
        ],
        "traits": {
            "produces_fruit": true,
            "genus": "Quercus",
            "height": 100,
            "extinct": false,
            "related_to": [
                {
                    "name": "chestnut",
                    "genus": "Castanea"
                },
                {
                    "name": "beech",
                    "genus": "Fagus"
                }
           ]
        },
        "locations": [
            "usa",
            "europe",
            "new york",
            "New York",
            "new york  ",
            "usa",
            "worldwide",
            "eu"
        ]
    }
}

Available macros

? (optional operator)

? is an optional operator for safe navigation, safe indexing, and conditional inclusion in CEL expressions.

The ? operator provides the following capabilities:

• Safe field navigation (obj.?field): Access fields without errors.
• Safe map indexing (map[?key]): Access map values safely.
• Safe list indexing (list[?index]): Access list elements safely.
• Optional map fields ({?key: value}): Conditionally include map fields.
• Optional list elements ([?element]): Conditionally include list elements.

After the first ? operator, subsequent accesses are automatically safe (viral chaining): obj.?field.subfield == obj.?field.?subfield.

Notes

• The ? operator returns optional values that need .orValue() or .hasValue().
• Safe navigation never throws errors on missing fields, keys, or indices.
• Optional field/element syntax requires optional-typed values.
• Use with optional.of(), optional.none(), or optional.ofNonZeroValue().

Examples

{'name': 'John'}.?name.orValue('Unknown')

{}.?name.orValue('Unknown')

{'a': 1, 'b': 2}[?'a'].orValue(0)

{'a': 1}[?'c'].orValue(0)

[1, 2, 3][?0].orValue(0)

[1, 2, 3][?10].orValue(0)

{?'key': optional.of(5)}.size()

{?'key': optional.none()}.size()

[1, ?optional.of(2), 3].size()

[1, ?optional.none(), 3].size()

abs

Returns the absolute value of the provided argument.

Input and output

abs(double) -> double
abs(int) -> int
abs(uint) -> uint

Examples

abs(-1.0)

abs(1.0)

all

Iterates on a list or map and validates that a condition is true for all elements in the list.

Input and output

all(list, predicate) -> bool
all(map, predicate) -> bool

Examples

[1,2,3,4].all(x, x > 0)

[1,2,3,0].all(x, x > 0)

append

Adds elements to an existing list.

Input and output

append(list, any) -> list

Examples

append([1, 2, 3], 4)

append([], "newElement")

assetTags

Returns a list of asset tag key/value pairs from an asset. By default, returns both keys and values. Optionally returns only keys or values.

Input and output

assetTags(map) -> list
assetTags(map, string) -> list

Examples

assetTags(inputs)

assetTags(inputs, "keys")

assetTags(inputs, "values")

base64.decode

Decodes a base64-encoded string to bytes.

Input and output

base64.decode(string) -> bytes

Decodes a base64-encoded string back to its original byte sequence.

Returns empty bytes for empty input.

The input must be a valid base64-encoded string.

Use cases

base64.decode('dXNlcm5hbWU6cGFzc3dvcmQ=')

string(base64.decode('aGVsbG8='))

string(base64.decode(api_response.encoded_data))

base64.decode(base64.encode(b'test'))

string(base64.decode(input.encoded_value))

base64.decode('')

string(base64.decode('aGVsbG8=')).upperAscii()

string(base64.decode('eyJrZXkiOiJ2YWx1ZSJ9'))

Error handling

• Invalid base64 strings will cause an error.
• Padding characters (=) are handled automatically.
• Whitespace in input may cause decoding errors.

Notes

• Input must be a valid base64-encoded string.
• Output is always a bytes type.
• Use string() conversion to get a string from bytes.
• Uses standard base64 decoding (RFC 4648).
• This coexists with the custom decodeBase64() function.

Common patterns

Decode and use as string:

string(base64.decode(encoded_input))

Most common pattern: decode and convert to a string.

Decode and process:

cel.bind(decoded, base64.decode(input), decoded.size() > 0 ? string(decoded) : 'empty')

Decode, check size, then convert or return a default value.

Round trip validation:

string(base64.decode(base64.encode(b'test'))) == 'test'

Validate that encoding and decoding work correctly.

Examples

base64.decode('aGVsbG8=')

base64.decode('aGVsbG8gd29ybGQ=')

base64.decode('dGVzdDEyMw==')

base64.decode('')

base64.encode

Encodes bytes to a base64-encoded string.

Input and output

base64.encode(bytes) -> string

Encodes a byte sequence to a base64-encoded string using standard base64 encoding.

Returns an empty string for empty input.

The output is a URL-safe base64 string.

Use cases

base64.encode(b'username:password')

base64.encode(file_content)

base64.encode(b'{"key": "value"}')

base64.encode(b'data with special chars: !@#$%')

string(base64.decode(base64.encode(b'test')))

base64.encode(bytes(input.text))

base64.encode(b'')

Notes

• Input must be a bytes type. Use b'...' syntax or bytes() conversion.
• Output is always a string.
• Uses standard base64 encoding (RFC 4648).
• Padding characters (=) are included as needed.
• This coexists with the custom encodeBase64() function.

Examples

base64.encode(b'hello')

base64.encode(b'hello world')

base64.encode(b'test123')

base64.encode(b'')

caseArchivedAt

Parses a case record and returns the date and time it was archived.

Input and output

caseArchivedAt(map) -> string

Examples

caseArchivedAt(inputs)

caseAssetEvidence

Parses a case record and returns the list of asset evidence objects.

Input and output

caseAssetEvidence(map) -> list

Examples

caseAssetEvidence(inputs)

caseAssigneeId

Parses a case record and returns the ID of the assignee.

Input and output

caseAssigneeId(map) -> string

Examples

caseAssigneeId(inputs)

caseChangeAfter

Returns an optional containing the after value for a field from delta.changes. Use .orValue() to provide a default or .hasValue() to check presence.

Input and output

caseChangeAfter(map, string) -> optional

Examples

caseChangeAfter(inputs, 'severity').orValue(0)

caseChangeAfter(inputs, 'severity').hasValue()

caseChangeAfter(inputs, 'nonexistent').orValue(0)

caseChangeAfter(inputs, 'nonexistent').hasValue()

caseChangeBefore

Returns an optional containing the before value for a field from delta.changes. Use .orValue() to provide a default or .hasValue() to check presence.

Input and output

caseChangeBefore(map, string) -> optional

Examples

caseChangeBefore(inputs, 'severity').orValue(0)

caseChangeBefore(inputs, 'severity').hasValue()

caseChangeBefore(inputs, 'nonexistent').orValue(0)

caseChangeBefore(inputs, 'nonexistent').hasValue()

caseChanges

Returns the delta.changes map from a case record. Each key is a field name, and each value is a map with before and after entries.

Input and output

caseChanges(map) -> map

Examples

caseChanges(inputs)

caseCloseReason

Parses a case record and returns the reason it was closed.

Input and output

caseCloseReason(map) -> string

Examples

caseCloseReason(inputs)

caseClosedAt

Parses a case record and returns the date and time it was closed (RFC3339), or an empty string when unset.

Input and output

caseClosedAt(map) -> string

Examples

caseClosedAt(inputs)

caseComment

Parses a case record and returns the comment associated with it.

Input and output

caseComment(map) -> string

Examples

caseComment(inputs)

caseCommentAuthorId

Parses a case record and returns the ID of the author of the comment.

Input and output

caseCommentAuthorId(map) -> string

Examples

caseCommentAuthorId(inputs)

caseCommentCreatedAt

Parses a case record and returns the date and time the comment was created.

Input and output

caseCommentCreatedAt(map) -> string

Examples

caseCommentCreatedAt(inputs)

caseCommentMentions

Parses a case record and returns a list of mentions in the comment.

Input and output

caseCommentMentions(map) -> list

Examples

caseCommentMentions(inputs)

caseCommentOperation

Parses a case record and returns the operation type of the comment.

Input and output

caseCommentOperation(map) -> string

Examples

caseCommentOperation(inputs)

caseContributorIds

Parses a case record and returns a list of contributor IDs.

Input and output

caseContributorIds(map) -> list

Examples

caseContributorIds(inputs)

caseCreatedAt

Parses a case record and returns the date and time it was created.

Input and output

caseCreatedAt(map) -> string

Examples

caseCreatedAt(inputs)

caseCreatedById

Parses a case record and returns the ID of the user that created it.

Input and output

caseCreatedById(map) -> string

Examples

caseCreatedById(inputs)

caseCreatedByPartner

Parses a case record and returns true if it was created by a parent of the tenant.

Input and output

caseCreatedByPartner(map) -> bool

Examples

caseCreatedByPartner(inputs)

caseDetectionEvidence

Parses a case record and returns the list of detection evidence objects.

Input and output

caseDetectionEvidence(map) -> list

Examples

caseDetectionEvidence(inputs)

caseEventEvidence

Parses a case record and returns the list of event evidence objects.

Input and output

caseEventEvidence(map) -> list

Examples

caseEventEvidence(inputs)

caseFieldChanged

Parses a case record and returns true if the provided field was modified.

Input and output

caseFieldChanged(map, string) -> bool

Examples

caseFieldChanged(inputs, 'priority')

caseFieldChanged(inputs, 'nonexistent_field')

caseFileId

Parses a case record and returns the file ID from delta.file (File Added events).

Input and output

caseFileId(map) -> string

Examples

caseFileId(inputs)

caseFileName

Parses a case record and returns the file name from delta.file (File Added events).

Input and output

caseFileName(map) -> string

Examples

caseFileName(inputs)

caseFileSize

Parses a case record and returns the file size from delta.file (File Added events).

Input and output

caseFileSize(map) -> int

Examples

caseFileSize(inputs)

caseFileStatus

Parses a case record and returns the file lifecycle status from delta.file (File Added/Deleted events).

Input and output

caseFileStatus(map) -> string

Examples

caseFileStatus(inputs)

caseFileUploadedById

Parses a case record and returns the user ID that uploaded the file from delta.file (File Added/Deleted events).

Input and output

caseFileUploadedById(map) -> string

Examples

caseFileUploadedById(inputs)

caseId

Parses a case record and returns the ID.

Input and output

caseId(map) -> string

Examples

caseId(inputs)

caseIncidentAdvisorId

Parses a case record and returns the incident advisor ID.

Input and output

caseIncidentAdvisorId(map) -> string

Examples

caseIncidentAdvisorId(inputs)

caseKeyFindings

Parses a case record and returns the key findings content.

With an optional second argument, returns a specific field from the keyFindings object (for example, documentType or documentVersion).

Input and output

caseKeyFindings(map) -> string
caseKeyFindings(map, string) -> string

Examples

caseKeyFindings(inputs)

caseKeyFindings(inputs, 'documentType')

caseKeyFindings(inputs, 'documentVersion')

caseLinkCreatedAt

Returns the link creation timestamp from a case-change event (delta.link) or a bare link record.

Input and output

caseLinkCreatedAt(map) -> string

Examples

caseLinkCreatedAt(inputs)

caseLinks(inputs).filter(l, caseLinkType(l) == 'External').map(l, caseLinkCreatedAt(l))

caseLinkIsInternal

Returns whether the link is internal from a case-change event (delta.link) or a bare link record.

Input and output

caseLinkIsInternal(map) -> bool

Examples

caseLinkIsInternal(inputs)

caseLinks(inputs).filter(l, caseLinkType(l) == 'External').map(l, caseLinkIsInternal(l))

caseLinkReference

Returns the link reference from a case-change event (delta.link) or a bare link record.

Input and output

caseLinkReference(map) -> string

Examples

caseLinkReference(inputs)

caseLinks(inputs).filter(l, caseLinkType(l) == 'External').map(l, caseLinkReference(l))

caseLinkTitle

Returns the link title from a case-change event (delta.link) or a bare link record.

Input and output

caseLinkTitle(map) -> string

Examples

caseLinkTitle(inputs)

caseLinks(inputs).filter(l, caseLinkType(l) == 'External').map(l, caseLinkTitle(l))

caseLinkType

Returns the link type from a case-change event (delta.link) or a bare link record.

Input and output

caseLinkType(map) -> string

Examples

caseLinkType(inputs)

caseLinks(inputs).filter(l, caseLinkType(l) == 'External')

caseLinkUrl

Returns the link URL from a case-change event (delta.link) or a bare link record.

Input and output

caseLinkUrl(map) -> string

Examples

caseLinkUrl(inputs)

caseLinks(inputs).filter(l, caseLinkType(l) == 'External').map(l, caseLinkUrl(l))

caseLinks

Parses a case record and returns the full list of link objects.

Input and output

caseLinks(map) -> list

Examples

caseLinks(inputs)

caseLinksReference

Parses a case record and returns the list of reference strings from all links.

Input and output

caseLinksReference(map) -> list

Examples

caseLinksReference(inputs)

caseLinksTitle

Parses a case record and returns the list of title strings from all links.

Input and output

caseLinksTitle(map) -> list

Examples

caseLinksTitle(inputs)

caseLinksType

Parses a case record and returns the list of type strings from all links (for example, External or Jira).

Input and output

caseLinksType(map) -> list

Examples

caseLinksType(inputs)

caseLinksUrl

Parses a case record and returns the list of URL strings from all links.

Input and output

caseLinksUrl(map) -> list

Examples

caseLinksUrl(inputs)

caseManagedBy

Parses a case record and returns the managed-by value (PROVIDER, CUSTOMER, UNKNOWN).

Input and output

caseManagedBy(map) -> string

Examples

caseManagedBy(inputs)

casePrimaryStatusId

Parses a case record and returns the primary status ID.

Input and output

casePrimaryStatusId(map) -> string

Examples

casePrimaryStatusId(inputs)

casePrimaryStatusName

Parses a case record and returns the primary status name.

Input and output

casePrimaryStatusName(map) -> string

Examples

casePrimaryStatusName(inputs)

casePrimaryStatusTitle

Parses a case record and returns the primary status title.

Input and output

casePrimaryStatusTitle(map) -> string

Examples

casePrimaryStatusTitle(inputs)

casePrimaryVerdictId

Parses a case record and returns the primary verdict ID.

Input and output

casePrimaryVerdictId(map) -> string

Examples

casePrimaryVerdictId(inputs)

casePrimaryVerdictName

Parses a case record and returns the primary verdict name.

Input and output

casePrimaryVerdictName(map) -> string

Examples

casePrimaryVerdictName(inputs)

casePrimaryVerdictTitle

Parses a case record and returns the primary verdict title.

Input and output

casePrimaryVerdictTitle(map) -> string

Examples

casePrimaryVerdictTitle(inputs)

casePriority

Parses a case record and returns the priority of the case as a word (Low, Medium, High, Critical).

An optional second argument of true returns the priority as an integer (1-4).

Input and output

casePriority(map) -> string
casePriority(map, bool) -> int

Examples

casePriority(inputs)

casePriority(inputs, true)

caseProcessingStatus

Parses a case record and returns the processing status map.

Input and output

caseProcessingStatus(map) -> map

Examples

caseProcessingStatus(inputs)

caseRiskScore

Parses a case record and returns the risk score.

Input and output

caseRiskScore(map) -> double

Examples

caseRiskScore(inputs)

caseRuleId

Parses a case record and returns the auto case rule ID that created it.

Input and output

caseRuleId(map) -> string

Examples

caseRuleId(inputs)

caseSearchEvidence

Parses a case record and returns the list of search evidence objects.

Input and output

caseSearchEvidence(map) -> list

Examples

caseSearchEvidence(inputs)

caseSecondaryStatusId

Parses a case record and returns the secondary status ID.

Input and output

caseSecondaryStatusId(map) -> string

Examples

caseSecondaryStatusId(inputs)

caseSecondaryStatusName

Parses a case record and returns the secondary status name.

Input and output

caseSecondaryStatusName(map) -> string

Examples

caseSecondaryStatusName(inputs)

caseSecondaryStatusReason

Parses a case record and returns the list of secondary status reasons.

Input and output

caseSecondaryStatusReason(map) -> list

Examples

caseSecondaryStatusReason(inputs)

caseSecondaryStatusTitle

Parses a case record and returns the secondary status title.

Input and output

caseSecondaryStatusTitle(map) -> string

Examples

caseSecondaryStatusTitle(inputs)

caseSecondaryVerdictId

Parses a case record and returns the secondary verdict ID.

Input and output

caseSecondaryVerdictId(map) -> string

Examples

caseSecondaryVerdictId(inputs)

caseSecondaryVerdictName

Parses a case record and returns the secondary verdict name.

Input and output

caseSecondaryVerdictName(map) -> string

Examples

caseSecondaryVerdictName(inputs)

caseSecondaryVerdictTitle

Parses a case record and returns the secondary verdict title.

Input and output

caseSecondaryVerdictTitle(map) -> string

Examples

caseSecondaryVerdictTitle(inputs)

caseSeverity

Parses a case record and returns the severity as a word (Informational, Low, Medium, High, Critical).

For inputs.case, uses severity values 2, 4, 6, 8, and 10. For V1/V2 records, uses priority values 1-4.

An optional second argument of false returns the raw numeric value.

Input and output

caseSeverity(map) -> string
caseSeverity(map, bool) -> int

Examples

caseSeverity(inputs)

caseSeverity(inputs, false)

caseShortId

Parses a case record and returns the short ID.

Input and output

caseShortId(map) -> string

Examples

caseShortId(inputs)

caseSourceId

Parses a case record and returns the source ID.

Input and output

caseSourceId(map) -> string

Examples

caseSourceId(inputs)

caseSourceName

Parses a case record and returns the source name.

Input and output

caseSourceName(map) -> string

Examples

caseSourceName(inputs)

caseSourceTitle

Parses a case record and returns the source display title.

Input and output

caseSourceTitle(map) -> string

Examples

caseSourceTitle(inputs)

caseStatus

Parses a case record and returns the status.

Input and output

caseStatus(map) -> string
caseStatus(map, string) -> string

Examples

caseStatus(inputs)

caseStatus(inputs, 'v1')

caseTags

Parses a case record and returns the list of tags.

Input and output

caseTags(map) -> list

Examples

caseTags(inputs)

caseTenantId

Parses a case record and returns the ID of the tenant.

Input and output

caseTenantId(map) -> string

Examples

caseTenantId(inputs)

caseThirdPartyId

Parses a case record and returns the ID of a third-party record associated with it.

Input and output

caseThirdPartyId(map) -> string

Examples

caseThirdPartyId(inputs)

caseThirdPartyType

Parses a case record and returns the type of a third-party record associated with it.

Input and output

caseThirdPartyType(map) -> string

Examples

caseThirdPartyType(inputs)

caseTitle

Parses a case record and returns the title.

Input and output

caseTitle(map) -> string

Examples

caseTitle(inputs)

caseType

Parses a case record and returns the type.

An optional second argument of 'v1' or 'v2' converts the type. The default is 'v2'.

Input and output

caseType(map) -> string
caseType(map, string) -> string

Examples

caseType(inputs)

caseType(inputs, 'v1')

caseTypeId

Parses a case record and returns the raw type ID from the structured type object.

Returns an empty string when the type is absent or not an object.

Input and output

caseTypeId(map) -> string

Examples

caseTypeId(inputs)

caseTypeTitle

Parses a case record and returns the type display title from the structured type object.

Returns an empty string when the type is absent or not an object.

Input and output

caseTypeTitle(map) -> string

Examples

caseTypeTitle(inputs)

caseUpdatedAt

Parses a case record and returns the date and time of the last update.

Input and output

caseUpdatedAt(map) -> string

Examples

caseUpdatedAt(inputs)

caseUpdatedById

Parses a case record and returns the ID of the user that last updated it.

Input and output

caseUpdatedById(map) -> string

Examples

caseUpdatedById(inputs)

cel.bind

Creates a local variable binding within an expression to avoid recomputing expensive operations.

Input and output

cel.bind(var_name, value, expression) -> any

Creates a local variable that can be referenced within the expression.

The variable is only available in the scope of the third argument (expression).

This is useful for:

• Avoiding repeated computation of expensive operations.
• Making complex expressions more readable.
• Creating intermediate values for cleaner logic.

The variable name is provided as an identifier (not a string).

The value can be any CEL expression.

The expression is evaluated with the variable in scope.

Use cases

cel.bind(name, inputs.user.name.uppercase(), name + ' - ' + string(name.size()))

cel.bind(withTax, inputs.price * 1.2, withTax > 100 ? withTax * 0.9 : withTax)

cel.bind(x, 5, cel.bind(y, x * 2, cel.bind(z, y + 3, x + y + z)))

cel.bind(nums, [1, 2, 3, 4, 5], cel.bind(doubled, nums.map(n, n * 2), doubled.filter(n, n > 5)))

cel.bind(user, inputs.users[0], user.name + ' (' + user.email + ')')

Examples

cel.bind(x, 10, x * x)

cel.bind(user, 'John', 'Hello ' + user)

cel.bind(list, [1,2,3], list.size() + list[0])

charAt

Returns the character at the specified index in the string.

Input and output

string.charAt(int) -> string

Returns the character (as a single-character string) at the specified zero-based index.

Returns an empty string if the index is out of bounds.

Examples

'hello'.charAt(0)

'hello'.charAt(4)

collect

Returns a list of map values that match the provided path argument.

Input and output

collect(list, string) -> list

Examples

[{\"a\": \"value1\"}, {\"b\": \"value2\"}, {\"a\": \"value3\"}].collect('a')

contains

Returns true if any element in the string or list matches the provided string or list (case-sensitive).

An optional second argument of true causes the match to ignore case.

Input and output

contains(string, string) -> bool
contains(string, string, bool) -> bool
contains(string, list) -> bool
contains(string, list, bool) -> bool
contains(list, string) -> bool
contains(list, string, bool) -> bool
contains(list, list) -> bool
contains(list, list, bool) -> bool

Examples

"apple".contains("app")

"apple".contains("APP", true)

"apple".contains(["app"])

"apple".contains(["APP"], true)

["apple", "banana"].contains("app")

["apple", "banana"].contains("APP", true)

["apple", "banana"].contains(["app"])

["apple", "banana"].contains(["APP"], true)

count

Returns a count of the list elements that match the provided string argument, or the keys in a map that match it.

Input and output

count(list, string) -> int

Examples

count([{"a": "value1"}, {"b": "value2"}, {"a": "value3"}], "a")

createShareLink

Returns a Taegis Sharelink for an alert, investigation, or asset.

Input and output

createShareLink(map) -> string

Examples

createShareLink(inputs)

decodeBase64

Returns a decoded base64 input string.

Input and output

decodeBase64(string) -> string

Examples

decodeBase64("aGVsbG8gd29ybGQ=")

decodeJSON

Returns a JSON object after decoding the input string.

Input and output

decodeJSON(string) -> any

Examples

decodeJSON('{"key": "value"}')

decodeYAML

Decodes YAML input to any data type.

Input and output

decodeYAML(string) -> any

Examples

decodeYAML("key: value")

detectionAttackTechniqueIds

Parses a detection record and returns the attack technique IDs value.

Input and output

detectionAttackTechniqueIds(map) -> list

Examples

detectionAttackTechniqueIds(inputs)

detectionConfidence

Parses a detection record and returns the confidence value.

Input and output

detectionConfidence(map) -> double

Examples

detectionConfidence(inputs)

detectionCreatedAtNanos

Parses a detection record and returns the nanoseconds value of the time the detection was created.

Input and output

detectionCreatedAtNanos(map) -> int

Examples

detectionCreatedAtNanos(inputs)

detectionCreatedAtSeconds

Parses a detection record and returns the created_at value as a measure of seconds from epoch.

Input and output

detectionCreatedAtSeconds(map) -> int

Examples

detectionCreatedAtSeconds(inputs)

detectionDescription

Parses a detection record and returns the description value.

Input and output

detectionDescription(map) -> string

Examples

detectionDescription(inputs)

detectionDestinationIPs

Parses a detection record and returns a unique list of IP address values from the detection entities field where the entity is labeled destinationIPAddress (case insensitive).

Input and output

detectionDestinationIPs(map) -> list

Examples

detectionDestinationIPs(inputs)

detectionDetectorId

Parses a detection record and returns the detector ID value.

Input and output

detectionDetectorId(map) -> string

Examples

detectionDetectorId(inputs)

detectionDetectorName

Parses a detection record and returns the detector name value.

Input and output

detectionDetectorName(map) -> string

Examples

detectionDetectorName(inputs)

detectionDomains

Parses a detection record and returns a unique list of domain name values from the detection entities field where the entity is labeled ipdomain, topprivateipdomain, domainname, authdomainname, sourceauthdomainname, or targetauthdomainname (case insensitive).

Input and output

detectionDomains(map) -> list

Examples

detectionDomains(inputs)

detectionEnrichment

Parses a detection record and the enrichment data and returns the first value matching the path provided.

Input and output

detectionEnrichment(map, string) -> any

Examples

detectionEnrichment(inputs, 'rare_program_rare_ip.programs')

detectionEnrichment(inputs, 'doesnotexist')

detectionEntities

Parses a detection record and returns the entities value.

Input and output

detectionEntities(map) -> list

Examples

detectionEntities(inputs)

detectionEntity

Parses a detection record and returns the entity values that match the provided entity name (case insensitive).

Input and output

detectionEntity(map, string) -> list

Examples

detectionEntity(inputs, 'username')

detectionEventIds

Parses a detection record and returns a list of event ID values.

Input and output

detectionEventIds(map) -> list

Examples

detectionEventIds(inputs)

detectionGroupKey

Parses a detection record and returns the group_key value.

Input and output

detectionGroupKey(map) -> string

Examples

detectionGroupKey(inputs)

detectionHostnames

Parses a detection record and returns a unique list of values from the detection entities field where the entity is labeled hostname, sourcehostname, desthostname, workstationname, or computername (case insensitive).

Input and output

detectionHostnames(map) -> list

Examples

detectionHostnames(inputs)

detectionIPs

Parses a detection record and returns a unique list of IP address values from the detection entities field where the entity is labeled ipAddress (case insensitive).

Input and output

detectionIPs(map) -> list

Examples

detectionIPs(inputs)

detectionId

Parses a detection record and returns the ID or UUID.

Input and output

detectionId(map) -> string

Examples

detectionId(inputs)

detectionInvestigationIds

Parses a detection record and returns a list of investigation IDs associated with the detection.

Input and output

detectionInvestigationIds(map) -> list

Examples

detectionInvestigationIds(inputs)

detectionMitreAttackInfo

Parses a detection record and returns a list of mitre_attack_info values.

Input and output

detectionMitreAttackInfo(map) -> list

Examples

detectionMitreAttackInfo(inputs)

detectionObservationIds

Parses a detection record and returns a list of observation ID values.

Input and output

detectionObservationIds(map) -> list

Examples

detectionObservationIds(inputs)

detectionReferences

Parses a detection record and returns a list of references associated with the detection.

Input and output

detectionReferences(map) -> list

Examples

detectionReferences(inputs)

detectionResolution

Parses a detection record and returns the resolution value.

Input and output

detectionResolution(map) -> string

Examples

detectionResolution(inputs)

detectionResolutionReason

Parses a detection record and returns the resolution reason value.

Input and output

detectionResolutionReason(map) -> string

Examples

detectionResolutionReason(inputs)

detectionRuleId

Parses a detection record and returns the rule ID.

Input and output

detectionRuleId(map) -> string

Examples

detectionRuleId(inputs)

detectionSensorIds

Parses a detection record and returns a list of sensor ID values.

Input and output

detectionSensorIds(map) -> list

Examples

detectionSensorIds(inputs)

detectionSensorTypes

Parses a detection record and returns a list of unique sensor type values (in uppercase).

Input and output

detectionSensorTypes(map) -> list

Examples

detectionSensorTypes(inputs)

detectionSeverity

Parses a detection record and returns the severity value.

Input and output

detectionSeverity(map) -> double

Examples

detectionSeverity(inputs)

detectionSeverityNice

Parses a detection record and returns the human-friendly severity value as a word (Informational, Low, Medium, High, Critical).

Input and output

detectionSeverityNice(map) -> string

Examples

detectionSeverityNice(inputs)

detectionSourceEntities

Returns the list of source entities from a detection's source_entities field.

Input and output

detectionSourceEntities(map) -> list

Examples

detectionSourceEntities(inputs)

detectionSourceEntityProperties

Filters source_entities by property_type and returns values for the specified property keys.

Input and output

detectionSourceEntityProperties(map, string, list) -> list

Examples

detectionSourceEntityProperties(inputs, "EntityUser", ["user_name", "original_user_name"])

detectionSourceIPs

Parses a detection record and returns a unique list of IP address values from the detection entities field where the entity is labeled sourceIPAddress (case insensitive).

Input and output

detectionSourceIPs(map) -> list

Examples

detectionSourceIPs(inputs)

detectionStatus

Parses a detection record and returns the status value.

Input and output

detectionStatus(map) -> string

Examples

detectionStatus(inputs)

detectionTags

Parses a detection record and returns a list of tags.

Input and output

detectionTags(map) -> list

Examples

detectionTags(inputs)

detectionTargetEntities

Returns the list of target entities from a detection's target_entities field.

Input and output

detectionTargetEntities(map) -> list

Examples

detectionTargetEntities(inputs)

detectionTargetEntityProperties

Filters target_entities by property_type and returns values for the specified property keys.

Input and output

detectionTargetEntityProperties(map, string, list) -> list

Examples

detectionTargetEntityProperties(inputs, "EntityFileHash", ["hash_value"])

detectionTenantId

Parses a detection record and returns the tenant ID.

Input and output

detectionTenantId(map) -> string

Examples

detectionTenantId(inputs)

detectionThirdPartyDetail

Parses a detection record and the third-party detail data and returns the first value matching the path provided.

Input and output

detectionThirdPartyDetail(map, string) -> list

Examples

detectionThirdPartyDetail(inputs, 'userStates.0.aadUserId')

detectionTitle

Parses a detection record and returns the title value.

Input and output

detectionTitle(map) -> string

Examples

detectionTitle(inputs)

detectionUpdatedAtNanos

Parses a detection record and returns the nanoseconds value of the time the detection was modified.

Input and output

detectionUpdatedAtNanos(map) -> int

Examples

detectionUpdatedAtNanos(inputs)

detectionUpdatedAtSeconds

Parses a detection record and returns the updated_at value as a measure of seconds from epoch.

Input and output

detectionUpdatedAtSeconds(map) -> int

Examples

detectionUpdatedAtSeconds(inputs)

detectionUsernames

Parses a detection record and returns a unique list of lowercase username values from the detection entities field where the entity is labeled username (case insensitive).

Input and output

detectionUsernames(map) -> list

Examples

detectionUsernames(inputs)

distinct

Removes duplicate elements from a list, preserving the first occurrence of each element.

Input and output

list.distinct() -> list

Returns a new list containing only unique elements from the original list.

The first occurrence of each element is preserved in the order encountered.

Duplicates are removed.

Use cases

user_tags.distinct()

results.map(r, r.category).distinct()

id_list.distinct()

inputs.values.distinct()

list1.distinct().size() == list1.size()

items.filter(i, i.active).map(i, i.id).distinct()

[3, 1, 2, 1, 3].distinct()

Notes

• Preserves the order of the first occurrence.
• Works with any comparable type.
• Empty lists remain empty.
• Doesn't sort the output.

Examples

[1, 2, 2, 3, 3, 3].distinct()

['b', 'b', 'c', 'a', 'c'].distinct()

[1, 2, 3].distinct()

[1, 1, 1].distinct()

[].distinct()

domains

Returns true if the provided username argument is in one or more of the provided domains.

Input and output

domains(map) -> list

Examples

domains(inputs)

encodeBase64

Returns an encoded string input as a base64 string.

Input and output

encodeBase64(string) -> string

Examples

encodeBase64("hello world")

encodeJSON

Returns an encoded string input as a JSON string.

Input and output

encodeJSON(string) -> string

Examples

encodeJSON({"key":"value"})

encodeYAML

Encodes any value as a YAML string.

Input and output

encodeYAML(string) -> string

Examples

encodeYAML({"key":"value"})

entityValue

Parses an entity record and returns a list of values for the provided entity property.

Input and output

entityValue(map, string) -> list

Examples

entityValue(inputs, "username")

entityValue(inputs, "nonexistent")

entityValues

Parses an entity record and returns a list of values associated with the entity.

Input and output

entityValues(map) -> list

Examples

entityValues(inputs)

exists

Iterates on a list or map and validates that a condition is true for at least one of the elements.

Input and output

exists(list, predicate) -> bool
exists(map, predicate) -> bool

Examples

[1, 2, 3].exists(i, i % 2 != 0)

{"x": "foo", "y": "bar"}.exists(key, key.startsWith("z"))

exists_one

Iterates on a list or map and validates that a condition is true for exactly one of the elements.

Input and output

exists_one(list, predicate) -> bool
exists_one(map, predicate) -> bool

Examples

[1, 2, 2].exists_one(i, i < 2)

{"a": "hello", "aa": "hellohello"}.exists_one(k, k.startsWith("a"))

filehashes

Returns a list of file hashes from an alert or entity if found.

Input and output

filehashes(map) -> list

Examples

filehashes(inputs)

filter

Iterates on a list and returns the elements that match the provided criteria.

Input and output

filter(list, predicate) -> list

Examples

["a", "ab", "c"].filter(x, x.contains("a"))

["a", "ab", "c"].filter(x, x.contains("d"))

findingCheck

Parses an identity finding record and returns the check map, or returns a specific entry when a second argument is provided.

Input and output

findingCheck(map) -> map
findingCheck(map, string) -> any

Examples

findingCheck(inputs)

findingCheck(inputs, "module")

findingCheck(inputs, "id")

findingCheck(inputs, "title")

findingCheck(inputs, "description")

findingCheck(inputs, "enabled")

findingClosedAt

Parses an identity finding record and returns the closed-at timestamp.

Input and output

findingClosedAt(map) -> string

Examples

findingClosedAt(inputs)

findingConfidenceScore

Parses an identity finding record and returns the confidence score.

Input and output

findingConfidenceScore(map) -> double

Examples

findingConfidenceScore(inputs)

findingFieldChanged

Parses a finding record and returns true if the provided field was modified.

Input and output

findingFieldChanged(map, string) -> bool

Examples

findingFieldChanged(inputs, 'status')

findingFieldChanged(inputs, 'nonexistent_field')

findingFirstSeen

Parses an identity finding record and returns the first-seen timestamp.

Input and output

findingFirstSeen(map) -> string

Examples

findingFirstSeen(inputs)

findingId

Parses an identity finding record and returns the ID.

Input and output

findingId(map) -> string

Examples

findingId(inputs)

findingIdentityCity

Parses an identity finding record and returns the city from the identity data.

Input and output

findingIdentityCity(map) -> string

Examples

findingIdentityCity(inputs)

findingIdentityCompanyName

Parses an identity finding record and returns the company name from the identity data.

Input and output

findingIdentityCompanyName(map) -> string

Examples

findingIdentityCompanyName(inputs)

findingIdentityCountry

Parses an identity finding record and returns the country from the identity data.

Input and output

findingIdentityCountry(map) -> string

Examples

findingIdentityCountry(inputs)

findingIdentityCreatedAt

Parses an identity finding record and returns the creation timestamp from the identity data.

Input and output

findingIdentityCreatedAt(map) -> string

Examples

findingIdentityCreatedAt(inputs)

findingIdentityDepartment

Parses an identity finding record and returns the department from the identity data.

Input and output

findingIdentityDepartment(map) -> string

Examples

findingIdentityDepartment(inputs)

findingIdentityDisplayName

Parses an identity finding record and returns the display name from the identity data.

Input and output

findingIdentityDisplayName(map) -> string

Examples

findingIdentityDisplayName(inputs)

findingIdentityEmails

Parses an identity finding record and returns the email addresses from the identity data.

Input and output

findingIdentityEmails(map) -> list

Examples

findingIdentityEmails(inputs)

findingIdentityEmployeeId

Parses an identity finding record and returns the employee ID from the identity data.

Input and output

findingIdentityEmployeeId(map) -> string

Examples

findingIdentityEmployeeId(inputs)

findingIdentityEmployeeType

Parses an identity finding record and returns the employee type from the identity data.

Input and output

findingIdentityEmployeeType(map) -> string

Examples

findingIdentityEmployeeType(inputs)

findingIdentityExternalCreatedAt

Parses an identity finding record and returns the external creation timestamp from the identity data.

Input and output

findingIdentityExternalCreatedAt(map) -> string

Examples

findingIdentityExternalCreatedAt(inputs)

findingIdentityExternalId

Parses an identity finding record and returns the external ID from the identity data.

Input and output

findingIdentityExternalId(map) -> string

Examples

findingIdentityExternalId(inputs)

findingIdentityExternalUpdatedAt

Parses an identity finding record and returns the external update timestamp from the identity data.

Input and output

findingIdentityExternalUpdatedAt(map) -> string

Examples

findingIdentityExternalUpdatedAt(inputs)

findingIdentityField

Parses a finding and returns the value of the specified identity field.

Input and output

findingIdentityField(map, string) -> bool

Examples

findingIdentityField(inputs, 'status')

findingIdentityField(inputs, 'nonexistent_field')

findingIdentityGivenName

Parses an identity finding record and returns the given name from the identity data.

Input and output

findingIdentityGivenName(map) -> string

Examples

findingIdentityGivenName(inputs)

findingIdentityHasMfa

Parses an identity finding record and returns whether MFA is enabled from the identity data.

Input and output

findingIdentityHasMfa(map) -> bool

Examples

findingIdentityHasMfa(inputs)

findingIdentityHasPasswordlessMfa

Parses an identity finding record and returns whether passwordless MFA is enabled from the identity data.

Input and output

findingIdentityHasPasswordlessMfa(map) -> bool

Examples

findingIdentityHasPasswordlessMfa(inputs)

findingIdentityHireDate

Parses an identity finding record and returns the hire date from the identity data.

Input and output

findingIdentityHireDate(map) -> string

Examples

findingIdentityHireDate(inputs)

findingIdentityIsAdmin

Parses an identity finding record and returns whether the identity has admin privileges.

Input and output

findingIdentityIsAdmin(map) -> bool

Examples

findingIdentityIsAdmin(inputs)

findingIdentityIsGuest

Parses an identity finding record and returns whether the identity is a guest user.

Input and output

findingIdentityIsGuest(map) -> bool

Examples

findingIdentityIsGuest(inputs)

findingIdentityLastActiveAt

Parses an identity finding record and returns the last active timestamp from the identity data.

Input and output

findingIdentityLastActiveAt(map) -> string

Examples

findingIdentityLastActiveAt(inputs)

findingIdentityLastPasswordChangeAt

Parses an identity finding record and returns the last password change timestamp from the identity data.

Input and output

findingIdentityLastPasswordChangeAt(map) -> string

Examples

findingIdentityLastPasswordChangeAt(inputs)

findingIdentityLeaveDate

Parses an identity finding record and returns the leave date from the identity data.

Input and output

findingIdentityLeaveDate(map) -> string

Examples

findingIdentityLeaveDate(inputs)

findingIdentityLocation

Parses an identity finding record and returns the location from the identity data.

Input and output

findingIdentityLocation(map) -> string

Examples

findingIdentityLocation(inputs)

findingIdentityManager

Parses an identity finding record and returns the manager from the identity data.

Input and output

findingIdentityManager(map) -> string

Examples

findingIdentityManager(inputs)

findingIdentityMfaMethods

Parses an identity finding record and returns the MFA methods from the identity data.

Input and output

findingIdentityMfaMethods(map) -> list

Examples

findingIdentityMfaMethods(inputs)

findingIdentityOfficeLocation

Parses an identity finding record and returns the office location from the identity data.

Input and output

findingIdentityOfficeLocation(map) -> string

Examples

findingIdentityOfficeLocation(inputs)

findingIdentityOfficeZipCode

Parses an identity finding record and returns the office zip code from the identity data.

Input and output

findingIdentityOfficeZipCode(map) -> string

Examples

findingIdentityOfficeZipCode(inputs)

findingIdentityPhoneNumbers

Parses an identity finding record and returns the phone numbers from the identity data.

Input and output

findingIdentityPhoneNumbers(map) -> list

Examples

findingIdentityPhoneNumbers(inputs)

findingIdentityPrimaryDomain

Parses an identity finding record and returns the primary domain from the identity data.

Input and output

findingIdentityPrimaryDomain(map) -> string

Examples

findingIdentityPrimaryDomain(inputs)

findingIdentityPrimaryEntityId

Parses an identity finding record and returns the primary entity ID from the identity data.

Input and output

findingIdentityPrimaryEntityId(map) -> string

Examples

findingIdentityPrimaryEntityId(inputs)

findingIdentityPrimaryMfaMethod

Parses an identity finding record and returns the primary MFA method from the identity data.

Input and output

findingIdentityPrimaryMfaMethod(map) -> string

Examples

findingIdentityPrimaryMfaMethod(inputs)

findingIdentityPrimaryUsername

Parses an identity finding record and returns the primary username from the identity data.

Input and output

findingIdentityPrimaryUsername(map) -> string

Examples

findingIdentityPrimaryUsername(inputs)

findingIdentityProperties

Parses an identity finding record and returns the properties map from the identity data.

Input and output

findingIdentityProperties(map) -> map

Examples

findingIdentityProperties(inputs)

findingIdentityProviderId

Parses an identity finding record and returns the provider ID from the identity data.

Input and output

findingIdentityProviderId(map) -> string

Examples

findingIdentityProviderId(inputs)

findingIdentityRaw

Parses an identity finding record and returns the raw identity data.

Input and output

findingIdentityRaw(map) -> map

Examples

findingIdentityRaw(inputs)

findingIdentityRegion

Parses an identity finding record and returns the region from the identity data.

Input and output

findingIdentityRegion(map) -> string

Examples

findingIdentityRegion(inputs)

findingIdentityStatus

Parses an identity finding record and returns the status from the identity data.

Input and output

findingIdentityStatus(map) -> string

Examples

findingIdentityStatus(inputs)

findingIdentitySurname

Parses an identity finding record and returns the surname from the identity data.

Input and output

findingIdentitySurname(map) -> string

Examples

findingIdentitySurname(inputs)

findingIdentityTenant

Parses an identity finding record and returns the tenant from the identity data.

Input and output

findingIdentityTenant(map) -> int

Examples

findingIdentityTenant(inputs)

findingIdentityTitle

Parses an identity finding record and returns the job title from the identity data.

Input and output

findingIdentityTitle(map) -> string

Examples

findingIdentityTitle(inputs)

findingIdentityUpdatedAt

Parses an identity finding record and returns the update timestamp from the identity data.

Input and output

findingIdentityUpdatedAt(map) -> string

Examples

findingIdentityUpdatedAt(inputs)

findingIdentityUsageLocation

Parses an identity finding record and returns the usage location from the identity data.

Input and output

findingIdentityUsageLocation(map) -> string

Examples

findingIdentityUsageLocation(inputs)

findingIdentityUsernames

Parses an identity finding record and returns the usernames from the identity data.

Input and output

findingIdentityUsernames(map) -> list

Examples

findingIdentityUsernames(inputs)

findingIdentityZipCode

Parses an identity finding record and returns the zip code from the identity data.

Input and output

findingIdentityZipCode(map) -> string

Examples

findingIdentityZipCode(inputs)

findingLastModified

Parses an identity finding record and returns the last modified timestamp.

Input and output

findingLastModified(map) -> string

Examples

findingLastModified(inputs)

findingLastSeen

Parses an identity finding record and returns the last seen timestamp.

Input and output

findingLastSeen(map) -> string

Examples

findingLastSeen(inputs)

findingOtherReferences

Parses an identity finding record and returns the other references list. An optional second argument returns a list of specific entries.

Input and output

findingOtherReferences(map) -> list
findingOtherReferences(map, string) -> list

Examples

findingOtherReferences(inputs)

findingOtherReferences(inputs, 'type')

findingOtherReferences(inputs, 'id')

findingOtherReferences(inputs, 'logicalType')

findingOtherReferences(inputs, 'derivedType')

findingOtherReferences(inputs, 'displayName')

findingOtherReferences(inputs, 'externalLink')

findingPrimaryReference

Parses an identity finding record and returns the primary reference map. An optional second argument returns a specific entry.

Input and output

findingPrimaryReference(map) -> map
findingPrimaryReference(map, string) -> string

Examples

findingPrimaryReference(inputs)

findingPrimaryReference(inputs, 'type')

findingPrimaryReference(inputs, 'id')

findingPrimaryReference(inputs, 'logicalType')

findingPrimaryReference(inputs, 'derivedType')

findingPrimaryReference(inputs, 'displayName')

findingPrimaryReference(inputs, 'externalLink')

findingResult

Parses an identity finding record and returns the result.

Input and output

findingResult(map) -> string

Examples

findingResult(inputs)

findingSeverity

Parses an identity finding record and returns the severity label (INFO, LOW, MEDIUM, HIGH, CRITICAL).

An optional second argument of true returns the severity as a double (0.0-1.0).

Input and output

findingSeverity(map) -> string
findingSeverity(map, bool) -> double

Examples

findingSeverity(inputs)

findingSeverity(inputs, true)

findingSource

Parses an identity finding record and returns the source map. An optional second argument returns a specific entry.

Input and output

findingSource(map) -> map
findingSource(map, string) -> any

Examples

findingSource(inputs)

findingSource(inputs, 'type')

findingSource(inputs, 'id')

findingSource(inputs, 'resolved')

findingStatus

Parses an identity finding record and returns the status.

Input and output

findingStatus(map) -> string

Examples

findingStatus(inputs)

findingStatusComments

Parses an identity finding record and returns the status comments.

Input and output

findingStatusComments(map) -> string

Examples

findingStatusComments(inputs)

findingTenantId

Parses an identity finding record and returns the tenant ID.

Input and output

findingTenantId(map) -> string

Examples

findingTenantId(inputs)

findingsStatusCommentsUserId

Parses an identity finding record and returns the user ID that added the status comments.

Input and output

findingsStatusCommentsUserId(map) -> string

Examples

findingsStatusCommentsUserId(inputs)

first (optional element)

Returns an optional containing the first element of a list, or optional.none() if the list is empty.

Input and output

list.first() -> optional(T)

Returns an optional containing the first element of a list. If the list is empty, returns optional.none().

Use cases

[1, 2, 3].first().orValue(0)

items.first().hasValue()

tasks.first().optMap(t, t.priority)

results.first().orValue('No results')

data.filter(x, x > 0).first().orValue(-1)

!items.first().hasValue() ? 'Empty list' : 'Has items'

Notes

• Returns optional(T), where T is the element type.
• Safely returns optional.none() for empty lists.
• Is more expressive than list[?0].
• Use .orValue() to provide a default.
• Doesn't modify the original list.

Examples

[1, 2, 3].first().orValue(0)

[].first().hasValue()

[].first().orValue(99)

['a', 'b', 'c'].first().value()

first (list elements)

Returns the first N elements of a list.

Input and output

first(list, int) -> list

Examples

first(["a", "c", "b"], 1)

flatten

Returns a list where all nested lists are combined into a single top-level list.

Input and output

flatten(list) -> list

Examples

flatten([["row1col1", "row1col2"], ["row2col1", "row2col2"]])

format (string)

Formats the string using printf-style formatting with the provided arguments.

Input and output

string.format(list) -> string

Formats the string using printf-style format specifiers with values from the list.

Common format specifiers:

• %s: String.
• %d: Integer.
• %f: Floating-point number.
• %%: Literal percent sign.

Examples

'Hello %s'.format(['World'])

'Value: %d, Name: %s'.format([42, 'test'])

'Pi: %.2f'.format([3.14159])

format (timestamp)

Returns the string representation of the timestamp using the provided format. See Constants for a list of supported formats.

Input and output

format(timestamp, string) -> string

Examples

"1/1/2012".toTimestamp().format("layout")

"1/1/2012".toTimestamp().format("dateonly")

"1/1/2012".toTimestamp().format("Mon")

generateString

Returns a randomly generated string with the length specified in the first argument and the characters or alphabet provided in the second argument.

Input and output

generateString(int, string) -> string

Examples

generateString(5, "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890")

groupBy

Returns a list of map elements grouped by one or more paths and a corresponding count of each grouping.

The first argument is the list to group. The second argument is a list of paths to group by. The optional third argument sorts the list in ascending (asc) or descending (desc) order. The default is ascending.

Input and output

groupBy(list, list, string) -> list

Examples

groupBy([{"amap": {"host": "test", "title": "test"}}, {"amap": {"host": "test", "title": "test"}}, {"amap": {"host": "test1", "title": "test"}}], ["amap.host", "amap.title"], "asc")

has

Validates that a key exists, is defined, and has a non-null value.

This macro also supports checking a map for one or more paths. An optional third argument specifies the separator used in the paths.

Input and output

has(map, string) -> bool

Examples

has(inputs, "key")

hasValue

Returns true if the optional contains a value. Otherwise, returns false.

Input and output

optional(T).hasValue() -> bool

Checks whether an optional contains a value.

Use cases

obj.?field.hasValue() ? obj.field : 'default'

input.?userId.hasValue()

!optional.none().hasValue()

data[?'key'].hasValue() && data['key'] > 10

items.filter(i, i.?metadata.hasValue())

Notes

• Returns a Boolean value (true or false).
• Is safe to call on any optional.
• Use before calling .value() to avoid errors.
• Is commonly used with conditional expressions.
• Provides an alternative to checking for errors.

Examples

optional.of(42).hasValue()

optional.none().hasValue()

{'a': 1}[?'a'].hasValue()

{'a': 1}[?'b'].hasValue()

[1, 2, 3][?0].hasValue()

[1, 2, 3][?10].hasValue()

hostnames

Parses an alert, entity, or asset and returns the hostnames found.

Input and output

hostnames(map) -> list

Examples

hostnames(inputs)

indexOf

Returns the index of the first occurrence of a substring.

Input and output

string.indexOf(string) -> int
string.indexOf(string, int) -> int

Returns the zero-based index of the first occurrence of the substring.

Returns -1 if the substring isn't found.

The optional second argument specifies the starting position for the search.

Examples

'hello world'.indexOf('world')

'hello world'.indexOf('o')

'hello world'.indexOf('o', 5)

'hello world'.indexOf('xyz')

ipInNetwork

Returns true if the first argument IP address is in one or more of the second argument IP network ranges.

The second argument is represented as a list of networks in CIDR notation.

Input and output

ipInNetwork(string, list) -> bool

Examples

ipInNetwork("10.1.1.1", ["10.0.0.0/8"])

ipInNetwork("192.168.1.1", ["10.0.0.0/8"])

ipsv4

Parses an alert or entity and returns a list of IPv4 addresses if found.

Input and output

ipsv4(map) -> list

Examples

ipsv4(inputs)

isCaseClosed

Parses a case record and returns whether the case is closed.

Input and output

isCaseClosed(map) -> bool

Examples

isCaseClosed(inputs)

isCaseVisibleToCustomers

Parses a case record and returns whether the case is visible to customers.

Input and output

isCaseVisibleToCustomers(map) -> bool

Examples

isCaseVisibleToCustomers(inputs)

isDomain

Returns true if the provided string argument represents a valid domain.

Input and output

isDomain(string) -> bool

Examples

isDomain("example.com")

isDomain("not_a_domain")

isEmail

Returns true if the provided string argument represents a valid email address.

Input and output

isEmail(string) -> bool

Examples

isEmail("sara@example.com")

isEmail("not_an_email")

isIP

Returns true if the provided string argument represents a valid IPv4 address.

Input and output

isIP(string) -> bool

Examples

isIP("127.0.0.1")

isIP("not_an_ip")

isPrivateIP

Returns true if the provided string argument represents a private (RFC-1918), link-local, or loopback IPv4 address.

Input and output

isPrivateIP(string) -> bool

Examples

isPrivateIP("192.168.1.1")

isPrivateIP("8.8.8.8")

isURL

Returns true if the provided string argument represents a valid Uniform Resource Locator (URL).

Input and output

isURL(string) -> bool
isURL(list) -> bool

Examples

isURL("https://example.com")

isURL("not_a_url")

isUUID

Returns true if the provided string argument represents a valid Universally Unique Identifier (UUID).

Input and output

isUUID(string) -> bool

Examples

isUUID("ce53ce61-0745-4b9b-ad16-568a022b6002")

isUUID("not_a_uuid")

join

Combines the elements of a list into a string using the provided separator.

The default separator is a comma character.

Input and output

join(list) -> string
join(list, string) -> string

Examples

join(["a", 1, true])

join(["a", 1, true], ".")

keys

Returns a list of top-level keys from a map.

Input and output

keys(map) -> list

Examples

keys({"foo": "bar", "a": "b"})

last (list elements)

Returns the last N elements of a list.

Input and output

last(list, int) -> list

Examples

last(["a", "c", "b"], 2)

last (optional element)

Returns an optional containing the last element of a list, or optional.none() if the list is empty.

Input and output

list.last() -> optional(T)

Returns an optional containing the last element of a list.

If the list is empty, returns optional.none().

Use cases

[1, 2, 3].last().orValue(0)

events.last().optMap(e, e.timestamp)

items.last().hasValue()

history.last().orValue('No history')

sequence.last().orValue(-1) > threshold

results.last().hasValue() ? 'Complete' : 'Empty'

Notes

• Returns optional(T), where T is the element type.
• Safely returns optional.none() for empty lists.
• Is more expressive than list[?list.size()-1].
• Use .orValue() to provide a default.
• Doesn't modify the original list.

Examples

[1, 2, 3].last().orValue(0)

[].last().hasValue()

[].last().orValue(99)

['a', 'b', 'c'].last().value()

lastIndexOf

Returns the index of the last occurrence of a substring.

Input and output

string.lastIndexOf(string) -> int
string.lastIndexOf(string, int) -> int

Returns the zero-based index of the last occurrence of the substring.

Returns -1 if the substring isn't found.

The optional second argument specifies the ending position for the search.

Examples

'hello world'.lastIndexOf('o')

'hello world'.lastIndexOf('l')

'hello world'.lastIndexOf('o', 6)

'hello world'.lastIndexOf('xyz')

list

Converts input to a list.

Input and output

list(any) -> list

Examples

list([{"a": 1, "b": 2}, {"a": 3, "b": 4}].map(x, x.a))

lists.range

Generates a list of sequential integers from 0 to n-1.

Input and output

lists.range(int) -> list

Generates a list of integers from 0 (inclusive) to n (exclusive).

Returns [0, 1, 2, ..., n-1].

Returns an empty list for values less than or equal to 0.

Use cases

lists.range(items.size())

lists.range(5).map(i, processItem(i))

lists.range(100)

lists.range(totalItems / batchSize).map(i, processBatch(i))

lists.range(totalPages)

lists.range(10).map(i, 'item-' + string(i))

lowerAscii

Converts all ASCII characters in the string to lowercase.

Input and output

string.lowerAscii() -> string

Converts all ASCII uppercase letters (A-Z) to lowercase (a-z).

Non-ASCII characters are left unchanged.

Examples

'HELLO World'.lowerAscii()

'ABC123XYZ'.lowerAscii()

'Café'.lowerAscii()

map

Converts input to a map.

Input and output

map(list) -> map

Examples

map([{"a": 1, "b": 2}, {"a": 3, "b": 4}].map(x, x.a))

matchGroup

Returns a list of strings from the provided regex capture group or groups.

Input and output

matchGroup(string, string) -> list

Examples

"https://www.example.com".matchGroup("([^:]+:\\/\\/)?([\\w]+[\\.\\w+]+)")

math.abs

Returns the absolute value of a number.

Input and output

math.abs(double) -> double
math.abs(int) -> int
math.abs(uint) -> uint

Returns the absolute (non-negative) value of the input number.

Works with int, uint, and double types.

Examples

math.abs(-5)

math.abs(5)

math.abs(-3.14)

math.abs(0)

math.bitAnd

Performs a bitwise AND operation on two integers.

Input and output

math.bitAnd(int, int) -> int
math.bitAnd(uint, uint) -> uint

Returns the bitwise AND of two integers.

Each bit in the result is 1 only if both corresponding bits in the operands are 1.

Examples

math.bitAnd(5, 3)

math.bitAnd(12, 10)

math.bitAnd(15, 15)

math.bitAnd(7, 0)

math.bitNot

Performs a bitwise NOT (complement) operation on an integer.

Input and output

math.bitNot(int) -> int
math.bitNot(uint) -> uint

Returns the bitwise complement of the integer.

Each bit is flipped: 0 becomes 1, and 1 becomes 0.

Examples

math.bitNot(0)

math.bitNot(-1)

math.bitNot(5)

math.bitNot(10)

math.bitOr

Performs a bitwise OR operation on two integers.

Input and output

math.bitOr(int, int) -> int
math.bitOr(uint, uint) -> uint

Returns the bitwise OR of two integers.

Each bit in the result is 1 if either corresponding bit in the operands is 1.

Examples

math.bitOr(5, 3)

math.bitOr(8, 4)

math.bitOr(0, 15)

math.bitOr(7, 0)

math.bitShiftLeft

Shifts the bits of an integer to the left by the specified number of positions.

Input and output

math.bitShiftLeft(int, int) -> int
math.bitShiftLeft(uint, uint) -> uint

Shifts all bits to the left by the specified number of positions.

Zeros are shifted in from the right. This is equivalent to multiplying by 2^n.

Examples

math.bitShiftLeft(5, 1)

math.bitShiftLeft(5, 2)

math.bitShiftLeft(1, 3)

math.bitShiftLeft(3, 4)

math.bitShiftRight

Shifts the bits of an integer to the right by the specified number of positions.

Input and output

math.bitShiftRight(int, int) -> int
math.bitShiftRight(uint, uint) -> uint

Shifts all bits to the right by the specified number of positions.

For unsigned integers, zeros are shifted in from the left.

For signed integers, the sign bit is preserved. This is equivalent to dividing by 2^n.

Examples

math.bitShiftRight(10, 1)

math.bitShiftRight(20, 2)

math.bitShiftRight(8, 3)

math.bitShiftRight(48, 4)

math.bitXor

Performs a bitwise XOR (exclusive OR) operation on two integers.

Input and output

math.bitXor(int, int) -> int
math.bitXor(uint, uint) -> uint

Returns the bitwise XOR of two integers.

Each bit in the result is 1 if the corresponding bits in the operands are different.

Examples

math.bitXor(5, 3)

math.bitXor(12, 10)

math.bitXor(15, 15)

math.bitXor(7, 0)

math.ceil

Rounds a number up to the nearest integer (towards positive infinity).

Input and output

math.ceil(double) -> double

Returns the smallest integer value greater than or equal to the input.

Always rounds up, even for negative numbers.

Examples

math.ceil(1.2)

math.ceil(1.9)

math.ceil(-1.2)

math.ceil(5.0)

math.floor

Rounds a number down to the nearest integer (towards negative infinity).

Input and output

math.floor(double) -> double

Returns the largest integer value less than or equal to the input.

Always rounds down, even for negative numbers.

Examples

math.floor(1.2)

math.floor(1.9)

math.floor(-1.2)

math.floor(5.0)

math.greatest

Returns the maximum value from the provided arguments.

Input and output

math.greatest(...) -> number

Returns the largest value among all provided arguments.

Accepts a variable number of arguments (int, uint, or double).

All arguments must be of comparable numeric types.

Examples

math.greatest(1, 5, 3, 9, 2)

math.greatest(-10, -5, -20)

math.greatest(1.5, 2.3, 0.9)

math.greatest(42)

math.isFinite

Checks if a value is a finite number (not NaN or infinity).

Input and output

math.isFinite(double) -> bool

Returns true if the value is a finite number (not NaN or infinity).

Returns false for NaN, positive infinity, or negative infinity.

Examples

math.isFinite(3.14)

math.isFinite(1.0 / 0.0)

math.isFinite(0.0 / 0.0)

math.isFinite(-100.5)

math.isInf

Checks if a value is positive or negative infinity.

Input and output

math.isInf(double) -> bool

Returns true if the value is infinity.

Examples

math.isInf(1.0 / 0.0)

math.isInf(-1.0 / 0.0)

math.isInf(1.0 / 0.0)

math.isInf(3.14)

math.isNaN

Checks if a value is NaN (Not a Number).

Input and output

math.isNaN(double) -> bool

Returns true if the value is NaN. Otherwise, returns false.

Only applies to floating-point values.

Examples

math.isNaN(0.0 / 0.0)

math.isNaN(1.0)

math.isNaN(math.sqrt(-1.0))

math.isNaN(3.14)

math.least

Returns the minimum value from the provided arguments.

Input and output

math.least(...) -> number

Returns the smallest value among all provided arguments.

Accepts a variable number of arguments (int, uint, or double).

All arguments must be of comparable numeric types.

Examples

math.least(1, 5, 3, 9, 2)

math.least(-10, -5, -20)

math.least(1.5, 2.3, 0.9)

math.least(42)

math.round

Rounds a number to the nearest integer (half away from zero).

Input and output

math.round(double) -> double

Returns the nearest integer value, rounding half values away from zero.

For positive numbers, 0.5 rounds up. For negative numbers, -0.5 rounds down.

Examples

math.round(1.4)

math.round(1.5)

math.round(-1.5)

math.round(5.0)

math.sign

Returns the sign of a number: -1 for negative, 0 for zero, and 1 for positive.

Input and output

math.sign(double) -> double
math.sign(int) -> int

Returns:

• -1 if the number is negative.
• 0 if the number is zero.
• 1 if the number is positive.

Examples

math.sign(-5)

math.sign(0)

math.sign(5)

math.sign(-3.14)

math.sqrt

Returns the square root of a number.

Input and output

math.sqrt(int) -> double
math.sqrt(double) -> double

Returns the square root of the input number.

Returns NaN for negative inputs.

Examples

math.sqrt(9.0)

math.sqrt(16)

math.sqrt(2.0)

math.sqrt(0.0)

math.trunc

Truncates a number to its integer part (towards zero).

Input and output

math.trunc(double) -> double

Returns the integer part of the number by removing the fractional part.

Rounds towards zero for both positive and negative numbers.

Examples

math.trunc(1.9)

math.trunc(-1.9)

math.trunc(5.0)

math.trunc(3.14159)

md5sum

Returns the computed MD5 digest for the provided string.

Input and output

md5sum(string) -> bytes

Examples

md5sum("Hello").toHex()

merge

Adds elements to an existing map.

Input and output

merge(map, map) -> map

Examples

merge({"key1": "val1"}, {"key2": "val2"})

now

Returns the current local time as a timestamp.

Input and output

now() -> timestamp

Examples

now()

nowUnixMilli

Returns the current time as the number of milliseconds since epoch.

Input and output

nowUnixMilli() -> int

Examples

nowUnixMilli()

optFlatMap

Transforms the optional's value with a function that returns an optional, flattening the result.

Input and output

optional(T).optFlatMap(var, expr) -> optional(R)

Applies a transformation that returns an optional.

Unlike optMap, this doesn't nest optionals. If the original optional is empty or the transformation returns optional.none(), the result is optional.none().

Use cases

optional.of([1, 2, 3]).optFlatMap(l, l[?0])

optional.of(value).optFlatMap(v, v > 0 ? optional.of(v * 2) : optional.none())

optional.of(user).optFlatMap(u, u.?email)

optional.of(input).optFlatMap(i, optional.ofNonZeroValue(i.trim()))

optional.of(config).optFlatMap(c, c[?'setting'])

Notes

• Variable binding syntax: optFlatMap(var, expression returning optional).
• Prevents nested optionals such as optional(optional(T)).
• Useful when the transformation itself returns an optional.
• Empty optionals pass through unchanged as optional.none().
• The transformation only runs when the optional contains a value.

Examples

optional.of([1, 2, 3]).optFlatMap(l, l[?0]).orValue(0)

optional.of([]).optFlatMap(l, l[?0]).orValue(0)

optional.none().optFlatMap(l, l[?0]).orValue(0)

optMap

Transforms the optional's value if present, returning a new optional with the transformed value.

Input and output

optional(T).optMap(var, expr) -> optional(R)

Applies a transformation to the optional's value if present.

The transformation returns a new value that is wrapped in an optional.

If the optional is empty, returns optional.none().

Use cases

optional.of(5).optMap(x, x * 2)

optional.of('hello').optMap(s, s.upperAscii())

optional.of(user).optMap(u, u.email)

optional.of([1, 2, 3]).optMap(l, l.size())

optional.of(10).optMap(x, x * 2).optMap(x, x + 1).orValue(0)

optional.of([1, 2, 3, 4, 5]).optMap(l, l.filter(x, x > 2))

data.?user.optMap(u, u.name).orValue('Anonymous')

Notes

• Variable binding syntax: optMap(var, expression using var).
• Returns optional(R) where R is the result type.
• Empty optionals pass through unchanged.
• Use .orValue() to extract the final result.
• Compare with .optFlatMap() when the transformation returns an optional.

Examples

optional.of(5).optMap(x, x * 2).orValue(0)

optional.none().optMap(x, x * 2).orValue(0)

optional.of('hello').optMap(s, s.upperAscii()).orValue('NONE')

optional.of([1, 2, 3]).optMap(l, l.size()).orValue(0)

optional.none

Creates an empty optional value with no content.

Input and output

optional.none() -> optional

Creates an empty optional value that contains no value.

Use cases

optional.none()

hasError ? optional.none() : optional.of(result)

optional.none().or(optional.of(5))

optional.none().hasValue()

optional.none().orValue('default')

Notes

• Represents the absence of a value (similar to null).
• .hasValue() returns false for optional.none().
• Calling .value() on optional.none() causes an error.
• Use .orValue() to provide a default value.
• Use .or() to chain with other optionals.

Examples

optional.none().hasValue()

optional.none().orValue(42)

optional.none().or(optional.of(5)).orValue(0)

optional.of

Creates an optional value containing the given value.

Input and output

optional.of(T) -> optional(T)

Creates an optional value that contains the given value.

Any value is considered valid, including zero values.

Use cases

optional.of(42)

optional.of(0)

optional.of('')

optional.of(5).optMap(x, x * 2)

hasValue ? optional.of(value) : optional.none()

optional.of(userInput).orValue('default')

Notes

• Accepts any value, including zero values such as 0, '', [], or {}.
• Returns optional(T) where T is the value type.
• Compare with optional.ofNonZeroValue(), which rejects zero values.
• Use .hasValue() to check whether a value exists.
• Use .orValue() to extract a value with a fallback.

Examples

optional.of(42)

optional.of('hello')

optional.of([1, 2, 3])

optional.of(0).hasValue()

optional.ofNonZeroValue

Creates an optional containing the value only if it's non-zero. Otherwise, returns optional.none().

Input and output

optional.ofNonZeroValue(T) -> optional(T)

Creates an optional containing the given value only if it's not a zero or empty value.

Zero values such as 0, '', [], {}, and null result in optional.none().

Use cases

optional.ofNonZeroValue(userInput)

optional.ofNonZeroValue('').hasValue()

optional.ofNonZeroValue([]).orValue([1, 2, 3])

optional.ofNonZeroValue(score).optMap(s, s * 100)

optional.ofNonZeroValue(null).orValue('N/A')

Notes

Zero values by type:

• Numeric: 0, 0.0
• String: ''
• List: []
• Map: {}
• Boolean: false
• Bytes: b''
• Null: null

Additional notes:

• Returns optional.none() for zero values.
• Use when you want to treat empty or zero values as absent.
• Compare with optional.of(), which accepts all values.
• Useful for validation and filtering.

Examples

optional.ofNonZeroValue(42).hasValue()

optional.ofNonZeroValue(0).hasValue()

optional.ofNonZeroValue('').hasValue()

optional.ofNonZeroValue('hello').hasValue()

or

Returns the first optional if it has a value. Otherwise, returns the second optional.

Input and output

optional(T).or(optional(T)) -> optional(T)

Chains optional values.

If the left optional has a value, it is returned. Otherwise, the right optional is returned.

Evaluation is short-circuited.

Use cases

optional.none().or(optional.of(5))

cache[?key].or(database[?key]).or(optional.of(default))

primary.or(secondary).or(tertiary).orValue(fallback)

obj.?field1.or(obj.?field2).orValue('none')

premium.?feature.or(basic.?feature)

Notes

• Returns optional(T), not T.
• Use .orValue() at the end to extract the final value.
• Short-circuits evaluation when the first optional has a value.
• Useful for chaining multiple optional sources.
• Compare with .orValue(), which returns a concrete value.

Examples

optional.none().or(optional.of(5)).orValue(0)

optional.of(3).or(optional.of(5)).orValue(0)

optional.none().or(optional.none()).orValue(10)

orValue

Returns the value from the optional if present. Otherwise, returns the provided default value.

Input and output

optional(T).orValue(T) -> T

Extracts the value from an optional if present, otherwise returns the provided default value.

Use cases

optional.none().orValue(42)

obj.?field.orValue('N/A')

config[?'timeout'].orValue(30)

items[?0].orValue('empty')

optional.of(5).orValue(0) * 2

data.?user.?name.orValue('Anonymous')

primary.orValue(secondary.orValue(tertiary))

Notes

• The default value must match the optional type.
• Always returns a concrete value.
• Safe to use anywhere a normal value is expected.
• More concise than conditional expressions.
• Compare with .value(), which throws an error for empty optionals.

Examples

optional.of(42).orValue(0)

optional.none().orValue(0)

optional.of('hello').orValue('default')

{'a': 1}[?'b'].orValue(0)

parseURL

Returns the provided URL string as a URL map structure.

Input and output

parseURL(string) -> map

Examples

parseURL("https://www.example.com")

queryJSON

Returns data from the first argument using the JMESPath query provided in the second argument.

Input and output

queryJSON(map, string) -> any

Examples

queryJSON(inputs.alert2, "metadata.confidence")

random

Returns a random value between 0 and .99 (inclusive).

Input and output

random() -> double

Examples

random()

regex.extract

Extracts the first match of a regular expression pattern from a string, returning an optional value.

Input and output

regex.extract(string, pattern) -> string

Applies a regular expression pattern to a string and returns the first match wrapped in an optional.

If the pattern contains a capturing group, the captured value is returned.

If the pattern contains no capturing groups, the entire match is returned.

Returns optional.none() if no match is found.

Notes

Pattern syntax:

• Uses RE2 regular expression syntax.
• Capturing groups use parentheses ().
• Backslashes must be escaped in CEL strings.
• Common patterns include \d, \w, and \s.

Additional notes:

• Returns an optional value. Use .orValue() or .hasValue().
• Pattern matching proceeds left-to-right and returns only the first match.
• Use extractAll() to retrieve all matches.
• Empty strings and empty patterns are handled gracefully.
• Invalid regex patterns cause compilation errors.

regex.extractAll

Extracts all matches of a regular expression pattern from a string as a list.

Input and output

regex.extractAll(string, pattern) -> list

Applies a regular expression pattern to a string and returns all matches as a list of strings.

Returns an empty list if no matches are found.

Unlike extract(), this function returns all matches, not just the first one.

Use cases

regex.extractAll('test123foo456bar', '\\d+')

regex.extractAll('hello world test', '\\w+')

regex.extractAll('192.168.1.1', '\\d+')

regex.extractAll(text, '\\w+@\\w+\\.\\w+')

regex.extractAll('test123foo456bar', '\\d+').size()

regex.extractAll('no-numbers-here', '\\d+').size() == 0