Cortex XQL Command Reference
Cortex XQL (Extended Query Language) is a powerful query language used in the Cortex platform for threat hunting, investigation, and analytics across your security data. This reference provides comprehensive documentation for all XQL functions and pipeline stages.
XQL queries are composed of stages connected in a pipeline, with functions used within those stages to transform, filter, and analyze data. This reference is organized into two main sections:
Functions – Built-in functions, indexes, and detailed reference pages.
Stages – Pipeline stages, indexes, and detailed reference pages.
Functions
Calculate the inverse cosine (arccosine) of a numerical expression
Calculate the inverse sine (arcsine) of a numerical expression
Perform a bitwise AND operation between two integer values
Perform a bitwise OR operation between two integer values
Perform a bitwise left shift operation on an integer value
Perform a bitwise right shift operation on an integer value
Perform a bitwise exclusive OR (XOR) operation between two integer values
Calculate the cube root of a numeric value
Round a number up to the nearest integer
Calculate the cosine of a numeric value specified in radians
Calculate the cosine distance between two numeric vectors
Calculate the cotangent of a numeric value specified in radians
Calculate the cosecant of a numeric value specified in radians
Calculate the Euclidean distance between two numeric vectors
Calculate the value of e raised to the power of a numeric value
Return the largest value from a list of expressions
A comprehensive guide to the four JSON extraction functions
Return the smallest value from a list of expressions
Collect all values of a field and return them as an array within the comp stage
Calculate the natural logarithm (base e) of a numeric value
Calculate the logarithm of a numeric value with a specified base
Calculate the base-10 logarithm of a numeric value
Return the maximum value of a field within the comp stage
Compute the maximum value of a field over a window of rows within the windowcomp stage
Return the median value of a numeric field within the comp stage
Compute the median value of a numeric field over a window of rows within the windowcomp stage
Return the minimum value of a field within the comp stage
Compute the minimum value of a field over a window of rows within the windowcomp stage
Calculate the remainder (modulus) of the division of two numeric values
Raise a number to the power of another number (alias for pow)
Generate a pseudo-random floating-point number between 0 and 1
Determine which bucket a numeric value falls into given an array of boundaries
Assign a rank to each row within a partition in the windowcomp stage
Extract a substring from a field value using a regular expression pattern
Assign a unique sequential integer to each row within a partition in the windowcomp stage
Perform addition with overflow protection, returning null on overflow
Perform division with error protection, returning null on division by zero
Perform multiplication with overflow protection, returning null on overflow
Negate a numeric value with overflow protection, returning null on overflow
Perform subtraction with overflow protection, returning null on overflow
Calculate the secant of a numeric value specified in radians
Determine the sign of a numeric value (-1, 0, or 1)
Calculate the sine of a numeric value specified in radians
Calculate the square root of a numeric value
Compute the population standard deviation of a numeric field within the comp stage
Compute the population standard deviation of a numeric field over a window of rows within the windowcomp stage
Compute the sample standard deviation of a numeric field within the comp stage
Compute the sample standard deviation of a numeric field over a window of rows within the windowcomp stage
Compute the sum of a numeric field within the comp stage
Compute the sum of a numeric field over a window of rows within the windowcomp stage
Calculate the tangent of a numeric value specified in radians
Truncate a numeric value to a specified number of decimal places
Collect all distinct values of a field and return them as an array within the comp stage
Compute the variance of a numeric field within the comp stage
Stages
Last updated
Was this helpful?