Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Who rated this post

L2 Linker

I think what you are looking for it the "in" operator.


config timeframe = 7d
| dataset = xdr_data
| filter action_device_usb_vendor_name in ("vendor_A", "vendor_B", "vendor_C")
| fields X, Y, Z

View solution in original post

Who rated this post