> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/supported-operators.md).

# Supported operators

Cortex Query Language (XQL) queries support the following comparison, boolean, string, range, and add operators.

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>Operator</td><td>Description</td></tr><tr><td>Comparison operators</td><td></td></tr><tr><td>=, !=</td><td>Equal, Not equal</td></tr><tr><td>&#x3C;, &#x3C;=</td><td>Less than, Less than or equal to</td></tr><tr><td>>, >=</td><td>Greater than, Greater than or equal to</td></tr><tr><td>Boolean operators</td><td></td></tr><tr><td>and</td><td>Boolean and</td></tr><tr><td>or</td><td>Boolean or</td></tr><tr><td>not</td><td>Boolean not</td></tr><tr><td>String and range operators</td><td></td></tr><tr><td>IN, NOT IN</td><td><p>Returns true if the integer or string field value is one of the options specified. For example:</p><p><code>action_local_port in(5900,5999)</code></p><p>For string field values, wildcards are supported. In this example a wildcard (<code>*</code>) is used to search if the value contains the strings <code>"word_1"</code> or <code>"word_2"</code> anywhere in the output, or exactly matches the string <code>"word"</code>:</p><p><code>str_field in ("*word_1*", "*word_2*", "word")</code></p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>In some cases, using an <code>IN</code> or <code>NOT IN</code> operator combined with a dataset and <code>filter</code> stage can be a better alternative to using a <code>join</code> stage.</p></div></td></tr><tr><td>CONTAINS, NOT CONTAINS</td><td><p>Performs a search for an integer or string. Returns true if the specified string is contained in the field. <code>Contains</code> and <code>Not Contains</code> are also supported within arrays for integers and strings.</p><p><strong>Example:</strong></p><pre><code>lowercase(actor_process_image_name) contains "psexec"
</code></pre></td></tr><tr><td>~=</td><td><p>Matches a regular expression.</p><p><strong>Example:</strong></p><pre><code>action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"
</code></pre></td></tr><tr><td>INCIDR, NOT INCIDR</td><td><p>Performs a search for an IPv4 address or IPv4 range using CIDR notation, and returns true if the address is in range.</p><p><strong>Example:</strong></p><pre><code>action_remote_ip incidr "192.1.1.1/24"
</code></pre><p>It is also possible to define multiple CIDRs with comma separated syntax when building a XQL query with the Query Builder or in Correlation Rules. When defining multiple CIDRs, the logical <code>OR</code> is used between the CIDRS listed, so as long as one address is in range the entire statement returns <code>true</code>. The same logic is used when using the <code>incidr()</code> function. For more information on how this logic works to determine whether the <code>incidr</code> or <code>not incidr</code> operators return <code>true</code> or <code>false</code>, see <code>incidr</code>.</p><p><strong>Example:</strong></p><pre><code>action_remote_ip incidr "192.168.0.0/24, 1.168.0.0/24"
</code></pre><p>Both the IPv4 address and CIDR ranges can be either an explicit string using quotes (<code>""</code>), such as <code>"192.168.0.1"</code>, or a string field.</p></td></tr><tr><td>INCIDR6, NOT INCIDR6</td><td><p>Performs a search for an IPv6 address or IPv6 range using CIDR notation, and returns true if the address is in range.</p><p><strong>Example:</strong></p><pre><code>action_remote_ip incidr6 “3031:3233:3435:3637:0000:0000:0000:0000/64”
</code></pre><p>It is also possible to define multiple CIDRs with comma separated syntax when building a XQL query with the Query Builder or in Correlation Rules. When defining multiple CIDRs, the logical <code>OR</code> is used between the CIDRS listed, so as long as one address is in range the entire statement returns <code>true</code>. The same logic is used when using the <code>incidr6()</code> function. For more information on how this logic works to determine whether the <code>incidr6</code> or <code>not incidr6</code> operators return <code>true</code> or <code>false</code>, see <code>incidr6</code>.</p><p><strong>Example:</strong></p><pre><code>action_remote_ip incidr6 "2001:0db8:85a3:0000:0000:8a2e:0000:0000/64, fe80::/10"
</code></pre><p>Both the IPv6 address and CIDR ranges can be either an explicit string using quotes (<code>""</code>), such as <code>“3031:3233:3435:3637:0000:0000:0000:0000/64”</code>, or a string field.</p></td></tr><tr><td>Add operator for tagging</td><td></td></tr><tr><td>add</td><td><p>The <code>add</code> operator is used in combination with the <code>tag</code> command to add a single tag or list of tags to a field that you can easily query in the dataset.</p><p><strong>Example:</strong></p><ul><li><p><strong>Adding a Single Tag</strong></p><pre><code>dataset = xdr_data
| tag add "test"
</code></pre></li><li><p><strong>Adding a List of Tags</strong></p><pre><code>dataset = xdr_data
| tag add "test1", "test2", "test3"
</code></pre></li></ul></td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/supported-operators.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.