bitwise_or ↗

Use the bitwise_or() function to perform a bitwise OR operation between two integer values.

Syntax

bitwise_or (<left_clause>, <right_clause>)

Parameters

Name Type Required Description
left_clause integer Yes The first integer value or field on which to perform the bitwise OR.
right_clause integer Yes The second integer value or field to OR against the first value.

Returns

The bitwise_or() function returns an integer representing the result of the bitwise OR operation between the two input parameters.

Usage notes

  • The function performs a bitwise OR (|) operation, comparing each bit of the first operand to the corresponding bit of the second operand. If either bit is 1, the corresponding result bit is set to 1; otherwise, it is set to 0.
  • Both parameters must be integers. Passing a string value will result in a validation error.
  • This function is commonly used to set specific bit flags or combine multiple bitmask values into a single field.
  • The function supports hexadecimal integer values when used with to_integer() (for example, to_integer("0x000b")).
  • The function is typically used within the alter or filter stages to create computed fields or filter events based on bitwise conditions.

Examples

Example 1: Set a specific bit flag in an integer field

Goal: Set bit 2 (value 4) in the event_type field, ensuring that flag is always present in the result.

XQL code:

config timeframe = 1d 
| dataset = xdr_data 
| alter with_flag = bitwise_or(event_type, 4) 
| fields event_id, event_type, with_flag 
| limit 3

Explanation: This query performs a bitwise OR between event_type and 4 (binary 100). If event_type is 3 (binary 011), the result is 7 (binary 111), ensuring bit 2 is set.

Output:

event_id event_type with_flag
101 3 7
102 5 5
103 0 4

Example 2: Combine two hexadecimal values and filter

Goal: Combine two hexadecimal values using bitwise OR and filter events where the result exceeds a threshold.

XQL code:

config timeframe = 1d 
| dataset = xdr_data 
| filter bitwise_or(to_integer("0x0004"), to_integer("0x000b")) > 2 
| fields event_id, event_type 
| limit 3

Explanation: This query computes the bitwise OR of 0x0004 (decimal 4, binary 0100) and 0x000b (decimal 11, binary 1011), resulting in 15 (binary 1111). Since 15 > 2, all events pass the filter.

Output:

event_id event_type
101 5
102 3
103 7

Example 3: Merge flags from two separate fields

Goal: Merge the bit flags from two separate integer fields into a single combined field.

XQL code:

config timeframe = 1d 
| dataset = xdr_data 
| alter combined_flags = bitwise_or(permission_read, permission_write) 
| fields event_id, permission_read, permission_write, combined_flags 
| limit 3

Explanation: This query combines the bit flags from permission_read and permission_write. For example, if permission_read is 1 (binary 01) and permission_write is 2 (binary 10), the result is 3 (binary 11), indicating both permissions are active.

Output:

event_id permission_read permission_write combined_flags
101 1 2 3
102 4 1 5
103 0 8 8