> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/if.md). # if **Syntax** **Regular if statement** ```programlisting if (, [, ]) ``` **Nested if/else statement** * ```programlisting if(, , , [, , ,...][, ]) ``` * ```programlisting if(, if(, [,])...[,]) ```

Note

In the above syntax, if(<boolean expression2>, <true return expression2> [,<false return expression2>]) represents the <true return expression1>.

**Description** The `if()` function evaluates a single expression or group of expressions depending on the syntax used to define the function. The syntax can be set up in the following ways: * Regular if statement: A single boolean expression is evaluated. If the expression evaluates as `true`, the function returns the results defined in the second function argument. If the expression evaluates as `false` and a false return expression is defined, the function returns the results of the third function argument; otherwise, if no false return expression is set, returns null. * Nested if/else statment: At least two boolean expressions and two true return expressions are required when using this option. The first boolean expression is evaluated. If the first expression evaluates as `true`, the function returns the results defined in the second function argument. The second boolean expression is evaluated. If the second expression evaluates as `true`, the function returns the results defined in the fourth function argument. If there are any other boolean expressions defined, they are evaluated following the same pattern when evaluated as `true`. If any of the expressions evaluates as `false` and a false return expression is defined, the function returns the results defined in the last function argument for the false return expression; otherwise, if no false return expression is set, returns null. **Examples**
Regular if statement If '.exe' is present on the `action_process_image_name` field value, replace that substring with an empty string. This example uses the [replace](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/replace.md) and [lowercase](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/lowercase.md) functions, as well as the contains operator to perform the conditional check. When the '.exe' is not present, the value is returned as is. ```programlisting dataset = xdr_data | fields action_process_image_name as apin | filter apin != null | alter remove_exe_process = if(lowercase(apin) contains ".exe", // boolean expression replace(lowercase(apin),".exe",""), // return if true lowercase(apin)) // return if false | limit 10 ```
Nested if/else statement Return a maximum of 1 `xdr_data` record from the past 7 days. The table results include a new column called `check_ip`, which evaluates and returns the following: * If the `action_local_ip` contains an IP address that begins with 10, return `Local 10`. * If the `action_local_ip` contains an IP address that begins with 172, return `Local 172 ?`. * If the `action_local_ip` contains an IP address that begins with 192.168, return `Local 192`. * If all the above expressions evaluate as `false`, return null. ```programlisting config timeframe = 7d | dataset = xdr_data | limit 1 | alter check_ip = if(action_local_ip ~= "^10",//boolean expression1 "Local 10", // true return expression1 action_local_ip ~= "^172", //boolean expression2 "Local 172 ?", //true return expression2 action_local_ip ~= "^192\.168", //boolean expression3 "Local 192") //true return expression3 ```
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/if.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.