> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-xql/get-started-with-xql/supported-operators.md).

# Supported operators

Cortex Query Language (XQL) queries support the following comparison, boolean, string, range, and add operators.

See [filter](/xql-command-reference-guide/readme/stages/filter.md), [join](/xql-command-reference-guide/readme/stages/join.md), [incidr](/xql-command-reference-guide/readme/functions/incidr.md), and [incidr6](/xql-command-reference-guide/readme/functions/incidr6.md) for related XQL reference material.

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>Operator</td><td>Description</td></tr><tr><td>Comparison operators</td><td></td></tr><tr><td>=, !=</td><td>Equal, Not equal</td></tr><tr><td>&#x3C;, &#x3C;=</td><td>Less than, Less than or equal to</td></tr><tr><td>>, >=</td><td>Greater than, Greater than or equal to</td></tr><tr><td>Boolean operators</td><td></td></tr><tr><td>and</td><td>Boolean and</td></tr><tr><td>or</td><td>Boolean or</td></tr><tr><td>not</td><td>Boolean not</td></tr><tr><td>String and range operators</td><td></td></tr><tr><td>IN, NOT IN</td><td><p>Returns true if the integer or string field value is one of the options specified. For example:</p><p><code>action_local_port in(5900,5999)</code></p><p>For string field values, wildcards are supported. In this example a wildcard (<code>*</code>) is used to search if the value contains the strings <code>"word_1"</code> or <code>"word_2"</code> anywhere in the output, or exactly matches the string <code>"word"</code>:</p><p><code>str_field in ("*word_1*", "*word_2*", "word")</code></p></td></tr><tr><td>CONTAINS, NOT CONTAINS</td><td><p>Performs a search for an integer or string. Returns true if the specified string is contained in the field. <code>Contains</code> and <code>Not Contains</code> are also supported within arrays for integers and strings.</p><p><strong>Example:</strong></p><pre><code>lowercase(actor_process_image_name) contains "psexec"
</code></pre></td></tr><tr><td>~=</td><td><p>Matches a regular expression.</p><p><strong>Example:</strong></p><pre><code>action_process_image_name ~= ".*?[.](?:pdf|docx)[.]exe"
</code></pre></td></tr><tr><td>INCIDR, NOT INCIDR</td><td><p>Performs a search for an IPv4 address or IPv4 range using CIDR notation, and returns true if the address is in range.</p><p><strong>Example:</strong></p><pre><code>action_remote_ip incidr "192.1.1.1/24"
</code></pre><p>Multiple CIDRs use comma-separated syntax. The logical <code>OR</code> applies between ranges.</p><p><strong>Example:</strong></p><pre><code>action_remote_ip incidr "192.168.0.0/24, 1.168.0.0/24"
</code></pre><p>IPv4 addresses and ranges can be quoted strings or string fields.</p></td></tr><tr><td>INCIDR6, NOT INCIDR6</td><td><p>Performs a search for an IPv6 address or IPv6 range using CIDR notation, and returns true if the address is in range.</p><p><strong>Example:</strong></p><pre><code>action_remote_ip incidr6 "3031:3233:3435:3637:0000:0000:0000:0000/64"
</code></pre><p>Multiple CIDRs use comma-separated syntax. The logical <code>OR</code> applies between ranges.</p><p><strong>Example:</strong></p><pre><code>action_remote_ip incidr6 "2001:0db8:85a3:0000:0000:8a2e:0000:0000/64, fe80::/10"
</code></pre><p>IPv6 addresses and ranges can be quoted strings or string fields.</p></td></tr><tr><td>Add operator for tagging</td><td></td></tr><tr><td>add</td><td><p>The <code>add</code> operator adds one or more tags to a field.</p><p><strong>Example:</strong></p><ul><li><p><strong>Adding a single tag</strong></p><pre><code>dataset = xdr_data
| tag add "test"
</code></pre></li><li><p><strong>Adding a list of tags</strong></p><pre><code>dataset = xdr_data
| tag add "test1", "test2", "test3"
</code></pre></li></ul></td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-xql/get-started-with-xql/supported-operators.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.