> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/incidrlist.md). # incidrlist Use the `incidrlist()` function to check if **all** IP addresses provided in a comma-separated list are contained within a given IPv4 CIDR range. ## Syntax ```sql incidrlis (, ) ``` ## Parameters | Name | Type | Required | Description | | ----------------- | ------ | -------- | ------------------------------------------------------------------------------------------- | | `IP_address list` | string | Yes | A string containing one or more IPv4 addresses, separated by commas. | | `CIDR_range` | string | Yes | A string literal specifying an IPv4 range in CIDR notation (for example, "192.168.1.0/24"). | ## Returns The `incidrlist()` function returns a boolean value (`true` or `false`). ## Usage notes * `incidrlist()` returns `true` only if **all** IP addresses within the address list fall within the specified CIDR range. * If even one IP address in the list is outside the CIDR, the function returns `false`. * The input `CIDR_range` only accepts a single CIDR range. If more are provided, the query fails. ## Examples ### Example 1: All IP addresses in list match the CIDR range **Goal**: Check if a list of IP addresses are all within a specific subnet. **XQL code**: ```sql config timeframe = 1d | dataset = sample_xql_raw | alter all_ips_in_range = incidrlist("192.168.1.10,192.168.10.20", "192.168.0.0/16") | fields event_id, all_ips_in_range | limit 3 ``` **Explanation**: For every record, the `incidrlist()` function evaluates if both `192.168.1.10` and `192.168.10.20` are within the `192.168.0.0/16` range. Because both are private IP addresses within this broader range, the function consistently returns `true`. **Output**: | EVENT\_ID | ALL\_IPS\_IN\_RANGE | | --------- | ------------------- | | 101 | true | | 102 | true | | 103 | true | ### Example 2: Not all IP addresses in list match the CIDR range **Goal**: Check a list containing a public IP against a private CIDR range. **XQL code**: ```sql config timeframe = 1d | dataset = sample_xql_raw | alter not_all_ips_in_range = incidrlist("192.168.1.10,203.0.113.15", "192.168.0.0/16") | fields event_id, not_all_ips_in_range | limit 3 ``` **Explanation**: The `incidrlist()` function checks each IP address in the list. Because `203.0.113.15` is not within `192.168.0.0/16`, the condition that **all** IP addresses must be in range is not met, resulting in `false` for every record. **Output**: | EVENT\_ID | NOT\_ALL\_IPS\_IN\_RANGE | | --------- | ------------------------ | | 101 | false | | 102 | false | | 103 | false | ### Example: Check an array of IP addresses against a CIDR range **Goal**: Evaluate whether any IP address within an array matches a specific CIDR block by first converting the array into a comma-separated string. **XQL Code**: ```sql dataset = panw_ngfw_traffic_raw | filter dest_ip != null | comp values(dest_ip) as dips by source_ip, action | alter dips = arraystring(dips, ", ") | alter inrange = incidrlist(dips, "192.168.10.0/24") | fields source_ip, action, dips, inrange | limit 100 ``` **Explanation**: The query targets the `panw_ngfw_traffic_raw` dataset, filtering out records where the destination IP is null. The query then uses the `comp` stage to aggregate all unique `dest_ip` values into an array named `dips`, grouped by `source_ip` and `action`. * Since the `incidrlist()` function requires a string input, the `arraystring()` function converts the `dips` array into a single string with values separated by a comma and a space. * The `incidrlist()` function then evaluates this string to determine if any of the IP addresses contained within it fall inside the "192.168.10.0/24" network range. * The result is stored in the `inrange` field as a boolean (`true` or `false`). **Output**: | source\_ip | action | dips | inrange | | ---------- | ------ | ---------------------------------- | ------- | | 10.1.1.5 | allow | 192.168.10.15, 8.8.8.8, 172.16.0.1 | true | | 10.1.1.10 | deny | 1.1.1.1, 10.50.50.2 | false | ## Related articles * **Stages**: [`alter`](/xql-command-reference-guide/readme/stages/alter.md), [`config`](/xql-command-reference-guide/readme/stages/config.md), [`fields`](/xql-command-reference-guide/readme/stages/fields.md), [`limit`](/xql-command-reference-guide/readme/stages/limit.md) * **Functions**: [`incidr`](/xql-command-reference-guide/readme/functions/incidr.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/incidrlist.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.