<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>Operator</td><td>Description</td></tr><tr><td>Comparison operators</td><td></td></tr><tr><td>=, !=</td><td>Equal, Not equal</td></tr><tr><td><, <=</td><td>Less than, Less than or equal to</td></tr><tr><td>>, >=</td><td>Greater than, Greater than or equal to</td></tr><tr><td>Boolean operators</td><td></td></tr><tr><td>and</td><td>Boolean and</td></tr><tr><td>or</td><td>Boolean or</td></tr><tr><td>not</td><td>Boolean not</td></tr><tr><td>String and range operators</td><td></td></tr><tr><td>IN, NOT IN</td><td><p>Returns true if the integer or string field value is one of the options specified. For example:</p><p><code>action_local_port in(5900,5999)</code></p><p>For string field values, wildcards are supported. In this example a wildcard (<code>*</code>) is used to search if the value contains the strings <code>"word_1"</code> or <code>"word_2"</code> anywhere in the output, or exactly matches the string <code>"word"</code>:</p><p><code>str_field in ("*word_1*", "*word_2*", "word")</code></p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>In some cases, using an <code>IN</code> or <code>NOT IN</code> operator combined with a dataset and <a href="https://app.gitbook.com/s/fUtoMSNyY2P8jbK3cQsM/readme/stages/filter">filter</a> stage can be a better alternative to using a <a href="https://app.gitbook.com/s/fUtoMSNyY2P8jbK3cQsM/readme/stages/join">join</a> stage.</p></div></td></tr><tr><td>CONTAINS, NOT CONTAINS</td><td><p>Performs a search for an integer or string. Returns true if the specified string is contained in the field. <code>Contains</code> and <code>Not Contains</code> are also supported within arrays for integers and strings.</p><p><strong>Example:</strong></p><pre><code>lowercase(actor_process_image_name) contains "psexec"
</code></pre></td></tr><tr><td>~=</td><td><p>Matches a regular expression.</p><p><strong>Example:</strong></p><pre><code>action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"
</code></pre></td></tr><tr><td>INCIDR, NOT INCIDR</td><td><p>Performs a search for an IPv4 address or IPv4 range using CIDR notation, and returns true if the address is in range.</p><p><strong>Example:</strong></p><pre><code>action_remote_ip incidr "192.1.1.1/24"
</code></pre><p>It is also possible to define multiple CIDRs with comma separated syntax when building a XQL query with the Query Builder or in Correlation Rules. When defining multiple CIDRs, the logical <code>OR</code> is used between the CIDRS listed, so as long as one address is in range the entire statement returns <code>true</code>. The same logic is used when using the <code>incidr()</code> function. For more information on how this logic works to determine whether the <code>incidr</code> or <code>not incidr</code> operators return <code>true</code> or <code>false</code>, see <a href="https://app.gitbook.com/s/fUtoMSNyY2P8jbK3cQsM/readme/functions/incidr">incidr</a>.</p><p><strong>Example:</strong></p><pre><code>action_remote_ip incidr "192.168.0.0/24, 1.168.0.0/24"
</code></pre><p>Both the IPv4 address and CIDR ranges can be either an explicit string using quotes (<code>""</code>), such as <code>"192.168.0.1"</code>, or a string field.</p></td></tr><tr><td>INCIDR6, NOT INCIDR6</td><td><p>Performs a search for an IPv6 address or IPv6 range using CIDR notation, and returns true if the address is in range.</p><p><strong>Example:</strong></p><pre><code>action_remote_ip incidr6 “3031:3233:3435:3637:0000:0000:0000:0000/64”
</code></pre><p>It is also possible to define multiple CIDRs with comma separated syntax when building a XQL query with the Query Builder or in Correlation Rules. When defining multiple CIDRs, the logical <code>OR</code> is used between the CIDRS listed, so as long as one address is in range the entire statement returns <code>true</code>. The same logic is used when using the <code>incidr6()</code> function. For more information on how this logic works to determine whether the <code>incidr6</code> or <code>not incidr6</code> operators return <code>true</code> or <code>false</code>, see <a href="https://app.gitbook.com/s/fUtoMSNyY2P8jbK3cQsM/readme/functions/incidr6">incidr6</a>.</p><p><strong>Example:</strong></p><pre><code>action_remote_ip incidr6 "2001:0db8:85a3:0000:0000:8a2e:0000:0000/64, fe80::/10"
</code></pre><p>Both the IPv6 address and CIDR ranges can be either an explicit string using quotes (<code>""</code>), such as <code>“3031:3233:3435:3637:0000:0000:0000:0000/64”</code>, or a string field.</p></td></tr><tr><td>Add operator for tagging</td><td></td></tr><tr><td>add</td><td><p>The <code>add</code> operator is used in combination with the <code>tag</code> command to add a single tag or list of tags to a field that you can easily query in the dataset.</p><p><strong>Example:</strong></p><ul><li><p><strong>Adding a Single Tag</strong></p><pre><code>dataset = xdr_data
| tag add "test"
</code></pre></li><li><p><strong>Adding a List of Tags</strong></p><pre><code>dataset = xdr_data
| tag add "test1", "test2", "test3"
</code></pre></li></ul></td></tr></tbody></table>