topic Iterating over an array in XQL in Cortex XDR Discussions

Iterating over an array in XQL

ogtay.nabili — Mon, 27 Nov 2023 12:24:36 GMT

Is there a way in XQL to iterate over an array?

Imagine there is an array of mail receivers i want to check if each one contains a specific keyword such as "@company.com" so that i know there's no receiver outside my organization.

emails = ["user1@company.com", "user2@anothercompany.com"] - i want to detect the second email.

Re: Iterating over an array in XQL

jtalton — Mon, 27 Nov 2023 23:00:15 GMT

Hi Ogtay.Nabili,

You may use the arrayindex and regextract functions. Please reference this previous discussion Solved: LIVEcommunity - XQL to get characters from Host Name - LIVEcommunity - 532962 (paloaltonetworks.com)

If you found this answer helpful please select Accept as Solution.

Thank you!