incidrlist ↗

Use the incidrlist() function to check if all IP addresses provided in a comma-separated list are contained within a given IPv4 CIDR range.

Syntax

incidrlis (<IP_address list>, <CIDR_range>)

Parameters

Name Type Required Description
IP_address list string Yes A string containing one or more IPv4 addresses, separated by commas.
CIDR_range string Yes A string literal specifying an IPv4 range in CIDR notation (for example, "192.168.1.0/24").

Returns

The incidrlist() function returns a boolean value (true or false).

Usage notes

  • incidrlist() returns true only if all IP addresses within the address list fall within the specified CIDR range.
  • If even one IP address in the list is outside the CIDR, the function returns false.
  • The input CIDR_range only accepts a single CIDR range. If more are provided, the query fails.

Examples

Example 1: All IP addresses in list match the CIDR range

Goal: Check if a list of IP addresses are all within a specific subnet.

XQL code:

config timeframe = 1d 
| dataset = sample_xql_raw 
| alter all_ips_in_range = incidrlist("192.168.1.10,192.168.10.20", "192.168.0.0/16") 
| fields event_id, all_ips_in_range 
| limit 3

Explanation: For every record, the incidrlist() function evaluates if both 192.168.1.10 and 192.168.10.20 are within the 192.168.0.0/16 range. Because both are private IP addresses within this broader range, the function consistently returns true.

Output:

EVENT_ID ALL_IPS_IN_RANGE
101 true
102 true
103 true

Example 2: Not all IP addresses in list match the CIDR range

Goal: Check a list containing a public IP against a private CIDR range.

XQL code:

config timeframe = 1d 
| dataset = sample_xql_raw 
| alter not_all_ips_in_range = incidrlist("192.168.1.10,203.0.113.15", "192.168.0.0/16") 
| fields event_id, not_all_ips_in_range 
| limit 3

Explanation: The incidrlist() function checks each IP address in the list. Because 203.0.113.15 is not within 192.168.0.0/16, the condition that all IP addresses must be in range is not met, resulting in false for every record.

Output:

EVENT_ID NOT_ALL_IPS_IN_RANGE
101 false
102 false
103 false

Example: Check an array of IP addresses against a CIDR range

Goal: Evaluate whether any IP address within an array matches a specific CIDR block by first converting the array into a comma-separated string.

XQL Code:

dataset = panw_ngfw_traffic_raw 
| filter dest_ip != null
| comp values(dest_ip) as dips by source_ip, action
| alter dips = arraystring(dips, ", ")
| alter inrange = incidrlist(dips, "192.168.10.0/24")
| fields source_ip, action, dips, inrange
| limit 100

Explanation: The query targets the panw_ngfw_traffic_raw dataset, filtering out records where the destination IP is null. The query then uses the comp stage to aggregate all unique dest_ip values into an array named dips, grouped by source_ip and action.

  • Since the incidrlist() function requires a string input, the arraystring() function converts the dips array into a single string with values separated by a comma and a space.
  • The incidrlist() function then evaluates this string to determine if any of the IP addresses contained within it fall inside the "192.168.10.0/24" network range.
  • The result is stored in the inrange field as a boolean (true or false).

Output:

source_ip action dips inrange
10.1.1.5 allow 192.168.10.15, 8.8.8.8, 172.16.0.1 true
10.1.1.10 deny 1.1.1.1, 10.50.50.2 false