incidrlist

Use the `incidrlist()` function to check if **all** IP addresses provided in a comma-separated list are contained within a given IPv4 CIDR range.

## Syntax

```sql
incidrlis (<IP_address list>, <CIDR_range>)
```

## Parameters

| Name | Type | Required | Description |
| ----------------- | ------ | -------- | ------------------------------------------------------------------------------------------- |
| `IP_address list` | string | Yes | A string containing one or more IPv4 addresses, separated by commas. |
| `CIDR_range` | string | Yes | A string literal specifying an IPv4 range in CIDR notation (for example, "192.168.1.0/24"). |

## Returns

The `incidrlist()` function returns a boolean value (`true` or `false`).

## Usage notes

* `incidrlist()` returns `true` only if **all** IP addresses within the address list fall within the specified CIDR range.
* If even one IP address in the list is outside the CIDR, the function returns `false`.
* The input `CIDR_range` only accepts a single CIDR range. If more are provided, the query fails.

## Examples

### Example 1: All IP addresses in list match the CIDR range

**Goal**: Check if a list of IP addresses are all within a specific subnet.

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw 
| alter all_ips_in_range = incidrlist("192.168.1.10,192.168.10.20", "192.168.0.0/16") 
| fields event_id, all_ips_in_range 
| limit 3 
```

**Explanation**: For every record, the `incidrlist()` function evaluates if both `192.168.1.10` and `192.168.10.20` are within the `192.168.0.0/16` range. Because both are private IP addresses within this broader range, the function consistently returns `true`.

**Output**:

| EVENT\_ID | ALL\_IPS\_IN\_RANGE |
| --------- | ------------------- |
| 101 | true |
| 102 | true |
| 103 | true |

### Example 2: Not all IP addresses in list match the CIDR range

**Goal**: Check a list containing a public IP against a private CIDR range.

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw 
| alter not_all_ips_in_range = incidrlist("192.168.1.10,203.0.113.15", "192.168.0.0/16") 
| fields event_id, not_all_ips_in_range 
| limit 3 
```

**Explanation**: The `incidrlist()` function checks each IP address in the list. Because `203.0.113.15` is not within `192.168.0.0/16`, the condition that **all** IP addresses must be in range is not met, resulting in `false` for every record.

**Output**:

| EVENT\_ID | NOT\_ALL\_IPS\_IN\_RANGE |
| --------- | ------------------------ |
| 101 | false |
| 102 | false |
| 103 | false |

### Example: Check an array of IP addresses against a CIDR range

**Goal**: Evaluate whether any IP address within an array matches a specific CIDR block by first converting the array into a comma-separated string.

**XQL Code**:

```sql
dataset = panw_ngfw_traffic_raw 
| filter dest_ip != null
| comp values(dest_ip) as dips by source_ip, action
| alter dips = arraystring(dips, ", ")
| alter inrange = incidrlist(dips, "192.168.10.0/24")
| fields source_ip, action, dips, inrange
| limit 100
```

**Explanation**: The query targets the `panw_ngfw_traffic_raw` dataset, filtering out records where the destination IP is null. The query then uses the `comp` stage to aggregate all unique `dest_ip` values into an array named `dips`, grouped by `source_ip` and `action`.

* Since the `incidrlist()` function requires a string input, the `arraystring()` function converts the `dips` array into a single string with values separated by a comma and a space.
* The `incidrlist()` function then evaluates this string to determine if any of the IP addresses contained within it fall inside the "192.168.10.0/24" network range.
* The result is stored in the `inrange` field as a boolean (`true` or `false`).

**Output**:

| source\_ip | action | dips | inrange |
| ---------- | ------ | ---------------------------------- | ------- |
| 10.1.1.5 | allow | 192.168.10.15, 8.8.8.8, 172.16.0.1 | true |
| 10.1.1.10 | deny | 1.1.1.1, 10.50.50.2 | false |

## Related articles

* **Stages**: [`alter`](../stages/alter), [`config`](../stages/config), [`fields`](../stages/fields), [`limit`](../stages/limit)
* **Functions**: [`incidr`](incidr)