case_sensitive

Learn more about the Cortex Query Language case_sensitive config stage.

Syntax

config case_sensitive = true | false

Description

The case_sensitive configuration identifies whether field values are evaluated as case sensitive or case insensitive. The config case_sensitive stage must be added at the beginning of the query. You can also add another config case_sensitive stage when adding a join or union stage to a query.

If you do not provide this stage in your query, the default behavior is false, and case is not considered when evaluating field values.

Things to keep in mind about before implementing this stage

• The Settings → Configurations → XQL Configuration → Case Sensitivity (case_sensitive) setting can overwrite this case_sensitive configuration for all fields in the application, except for BIOCs, which will remain case insensitive no matter what this setting is set to.
• From Cortex XDR version 3.3, the default case sensitivity setting was changed to case insensitive (config case_sensitive = false). If you've been using Cortex XDR before this version was released, the default case sensitivity setting is still configured to be case sensitive (config case_sensitive = true).
• The config case_sensitive stage can't be used to compare a field to an inner query. In this situation, ensure to use the lowercase or uppercase functions on the field and inner query stages and functions syntax.

  Example 113.

  This query won't provide the correct results of comparing the agent_hostname field with the inner query:

  config case_sensitive = false 
  | dataset = xdr_data 
  | fields agent_hostname
  | filter agent_hostname in (dataset = <lookup dataset> | fields agent_hostname)

  This query will provide the correct output:

  config case_sensitive = false  
  | dataset = xdr_data
  | fields agent_hostname 
  | filter lowercase(agent_hostname) in (dataset = <lookup dataset> | alter lower_agent_hostname = lowercase(agent_hostname) | fields lower_agent_hostname)

• The config case_sensitive stage can't be used to compare a field to an array that contains non-literal strings, for example a field name or function.

  Example 114.

  The results of this example are true, where the left side (uppercase("a")) is lowercase as it's not an array, and the right side (("x", "A")) is also an array that contains only literal strings.

  | alter field_name = if(uppercase("a") in ("x", "A"), true, false)

  Example 115.

  The results of this example are false, where the left side (uppercase("a")) is lowercase as it's not an array, and the right side ("x", uppercase("a"))) is an array that contains a function (uppercase("a")).

  | alter field_name = if(uppercase("a") in ("x", uppercase("a")),true, false)

Examples

config case_sensitive = true 
| dataset = xdr_data 
| fields actor_process_image_name as apin 
| filter apin != NULL and apin contains "python" 
| limit 100