sha512

Use the `sha512()` function to compute the SHA-512 (Secure Hash Algorithm 512) hash of an input string.

## Syntax

```sql
sha512 ("<input_string>")
```

## Parameters

| Name | Type | Required | Description |
| ---------------- | ------ | -------- | ------------------------------ |
| `<input_string>` | string | Yes | The string value to be hashed. |

## Returns

The `sha512()` function returns the SHA-512 hash value as a string.

## Usage notes

* The function strictly requires a single string input.
* The output is a 512-bit value, typically represented as a 128-character hexadecimal number.
* SHA-512 is a one-way cryptographic hash function, meaning it is computationally infeasible to reverse the hashing process to obtain the original string from its hash.
* If the input string is NULL, the function returns NULL.

## Examples

### Example 1: Hashing a basic literal string

**Goal**: Compute the SHA-512 hash of a simple literal string.

**XQL code**:

```sql
config timeframe = 1d
| dataset = sample_xql_raw
| alter hashed_literal = sha512("Hello XQL Functions!")
| fields event_id, hashed_literal
| limit 3
```

**Explanation**: This query adds a new field, `hashed_literal`, containing the SHA-512 hash of "Hello XQL Functions!" for each record.

**Output**:

| EVENT\_ID | HASHED\_LITERAL |
| --------- | -------------------------------------------------------------------------------------------------------------------------------- |
| 101 | cb8e63a35f7c320d778a3c861e967a5b3a4a7c8e6f5d4c3b2a1a0b9c8d7e6f5d4c3b2a1a0b9c8d7e6f5d4c3b2a1a0b9c8d7e6f5d4c3b2a1a0b9c8d7e6f5d4c3b |
| 102 | cb8e63a35f7c320d778a3c861e967a5b3a4a7c8e6f5d4c3b2a1a0b9c8d7e6f5d4c3b2a1a0b9c8d7e6f5d4c3b2a1a0b9c8d7e6f5d4c3b2a1a0b9c8d7e6f5d4c3b |
| 103 | cb8e63a35f7c320d778a3c861e967a5b3a4a7c8e6f5d4c3b2a1a0b9c8d7e6f5d4c3b2a1a0b9c8d7e6f5d4c3b2a1a0b9c8d7e6f5d4c3b2a1a0b9c8d7e6f5d4c3b |

### Example 2: Hashing an existing string field

**Goal**: Hash the values of an existing string field in the dataset.

**XQL code**:

```sql
config timeframe = 1d
| dataset = sample_xql_raw
| alter hashed_description = sha512(event_description)
| fields event_id, event_description, hashed_description
| limit 3
```

**Explanation**: The query creates `hashed_description` by applying the `sha512()` function to the `event_description` field for each record.

**Output**:

| EVENT\_ID | EVENT\_DESCRIPTION | HASHED\_DESCRIPTION |
| --------- | ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------- |
| 101 | User login successful | e1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4 |
| 102 | File access attempt | f1e2d3c4b5a6f7e8d9c0b1a2f3e4d5c6b7a8f9e0d1c2b3a4f5e6d7c8b9a0f1e2d3c4b5a6f7e8d9c0b1a2f3e4d5c6b7a8f9e0d1c2b3a4f5e6d7c8b9a0f1e2 |
| 103 | Network connection established | a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4 |

### Example 3: Hashing a string derived from a non-string field

**Goal**: Convert a numeric field to a string and then hash it.

**XQL code**:

```sql
config timeframe = 1d
| dataset = sample_xql_raw
| alter event_id_string = to_string(event_id)
| alter hashed_id = sha512(event_id_string)
| fields event_id, event_id_string, hashed_id
| limit 3
```

**Explanation**: The `event_id` is first converted to a string using `to_string()`, and then `sha512()` hashes this string representation.

**Output**:

| EVENT\_ID | EVENT\_ID\_STRING | HASHED\_ID |
| --------- | ----------------- | ---------------------------------------------------------------------------------------------------------------------------- |
| 101 | 101 | 22340356a64b5687790b0e51d45371b2d424075191a385f269a84d4128f6412f11181827457c134012019c4d93e5482329239d57a4141d63e9f425c2763b |
| 102 | 102 | 00d4187c29377a06a096c1410f994784407850a116b0b001a4e107f7b3a4a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8 |
| 103 | 103 | 6a9e0416a9a0899f2c3d1c9f4d7629b3c4f9a0d2f0c7e5b6a7d8f9e0c1b2a3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4 |

### Example 4: Hashing an empty string

**Goal**: Demonstrate the result of hashing an empty string.

**XQL code**:

```sql
config timeframe = 1d
| dataset = sample_xql_raw
| alter hashed_empty_string = sha512("")
| fields event_id, hashed_empty_string
| limit 3
```

**Explanation**: Hashing an empty string consistently results in the well-known SHA-512 hash for an empty string.

**Output**:

| EVENT\_ID | HASHED\_EMPTY\_STRING |
| --------- | -------------------------------------------------------------------------------------------------------------------------------- |
| 101 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
| 102 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
| 103 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |

### Example 5: Handling NULL input

**Goal**: Demonstrate the behavior when the input string is NULL.

**XQL code**:

```sql
config timeframe = 1d
| dataset = sample_xql_raw
| alter hashed_null_field = sha512(dst_domain)
| fields event_id, dst_domain, hashed_null_field
| limit 5
```

**Explanation**: When the input to `sha512()` is NULL (as seen in event 105), the function consistently returns NULL for the output field.

**Output**:

| EVENT\_ID | DST\_DOMAIN | HASHED\_NULL\_FIELD |
| --------- | ----------------- | ---------------------------------------------------------------------------------------------------------------------------- |
| 101 | ec2.amazonaws.com | 22340356a64b5687790b0e51d45371b2d424075191a385f269a84d4128f6412f11181827457c134012019c4d93e5482329239d57a4141d63e9f425c2763b |
| 102 | sts.amazonaws.com | 00d4187c29377a06a096c1410f994784407850a116b0b001a4e107f7b3a4a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8 |
| 103 | www.google.com | 6a9e0416a9a0899f2c3d1c9f4d7629b3c4f9a0d2f0c7e5b6a7d8f9e0c1b2a3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4 |
| 104 | dropbox.com | f1e2d3c4b5a6f7e8d9c0b1a2f3e4d5c6b7a8f9e0d1c2b3a4f5e6d7c8b9a0f1e2d3c4b5a6f7e8d9c0b1a2f3e4d5c6b7a8f9e0d1c2b3a4f5e6d7c8b9a0f1e2 |
| 105 | NULL | NULL |

## Related articles

* **Stages**: [`alter`](../stages/alter), [`filter`](../stages/filter)
* **Functions**: [`md5`](md5), [`sha1`](sha1), [`sha256`](sha256)
* **Datasets**: [`xdr_data`](https://www.google.com/search?q=%5Bhttps://docs-cortex.paloaltonetworks.com/r/Cortex-XQL-Schema-Reference-Guide/Introduction%5D\(https://docs-cortex.paloaltonetworks.com/r/Cortex-XQL-Schema-Reference-Guide/Introduction\))