bitwise_and ↗

Use the bitwise_and() function to perform a bitwise AND operation between two integer values.

Syntax

bitwise_and (<left_clause>, <right_clause>)

Parameters

Name Type Required Description
left_clause integer Yes The first integer value or field on which to perform the bitwise AND.
right_clause integer Yes The second integer value or field to AND against the first value.

Returns

The bitwise_and() function returns an integer representing the result of the bitwise AND operation between the two input parameters.

Usage notes

  • The function performs a bitwise AND (&) operation, comparing each bit of the first operand to the corresponding bit of the second operand. If both bits are 1, the corresponding result bit is set to 1; otherwise, it is set to 0.
  • Both parameters must be integers. Passing a string value will result in a validation error.
  • This function is commonly used to check whether specific bit flags are set in a bitmask field.
  • The function supports hexadecimal integer values when used with to_integer() (for example, to_integer("0x02")).
  • The function is typically used within the alter or filter stages to create computed fields or filter events based on bitwise conditions.

Examples

Example 1: Check a specific bit flag in an integer field

Goal: Use a bit mask to check whether a specific flag (bit 1, value 2) is set in the xdm.case.score field.

XQL code:

config timeframe = 1d 
| dataset = xdr_data 
| alter flag_check = bitwise_and(xdm.case.score, 2) 
| fields event_id, xdm.case.score, flag_check 
| limit 3

Explanation: This query performs a bitwise AND between xdm.case.score and 2 (binary 10). If bit 1 is set in xdm.case.score, flag_check will be 2; otherwise, it will be 0.

Output:

event_id xdm.case.score flag_check
101 7 2
102 4 0
103 3 2

Example 2: Filter events using a bitwise AND with hexadecimal values

Goal: Filter events where a specific bit flag (0x02) is set in the xdm.case.score field, using hexadecimal notation.

XQL code:

config timeframe = 1d 
| dataset = xdr_data 
| filter bitwise_and(xdm.case.score, to_integer("0x02")) > 0
| fields event_id, xdm.case.score 
| limit 3

Explanation: This query filters for events where bit 1 (value 2) is set in xdm.case.score. The to_integer("0x02") converts the hexadecimal value 0x02 to the integer 2, which is used as the bitmask. The bitwise_and() result is either 2 (bit is set) or 0 (bit is not set). Only events where the result is greater than 0 pass the filter.

Output:

event_id xdm.case.score
103 7
107 15
112 6

Example 3: Mask out the lower 8 bits of an integer field

Goal: Extract the lower 8 bits from a numeric field using a bit mask of 255 (binary 11111111).

XQL code:

config timeframe = 1d 
| dataset = xdr_data 
| alter lower_byte = bitwise_and(action_status, 255) 
| fields event_id, action_status, lower_byte 
| limit 3

Explanation: This query isolates the lower 8 bits of the action_status field. For a value of 258 (binary 100000010), the result is 2 (binary 00000010).

Output:

event_id action_status lower_byte
101 258 2
102 511 255
103 1024 0