> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/wildcard_match.md).

# wildcard\_match

Use the `wildcard_match` function to determine if a given string matches a specified wildcard pattern. The function is primarily used for flexible pattern matching beyond literal equality, often for filtering or categorizing data.

## Syntax

```sql
wildcard_match(<string_value>, <wildcard_pattern>)
```

## Parameters

| Name               | Type   | Required | Description                                                                  |
| ------------------ | ------ | -------- | ---------------------------------------------------------------------------- |
| `string_value`     | string | Yes      | The input string field or literal value to be evaluated against the pattern. |
| `wildcard_pattern` | string | Yes      | The pattern string, which can include wildcard characters `*` and `?`.       |

## Returns

The function returns a boolean value: `true` if the string matches the pattern, and `false` otherwise.

## Usage notes

* **Availability**: This function is only available with Cortex XSIAM licenses that include Cortex Cloud.
* **Wildcard characters**:
* `*` (Asterisk): Matches a sequence of zero or more (possibly different) characters.
* `?` (Question Mark): Matches exactly one character.
* **Case sensitivity**: By default, the function is case-sensitive. To perform a case-insensitive match, you must add the `(?i)` syntax once at the beginning of the regular expression within the pattern string.
* **Stage usage**: This function is typically used within the `alter` stage to create new boolean fields or directly within `filter` stages to narrow down results.

## Examples

### Example 1: Basic wildcard matching with `*`

**Goal**: Check if the `event_description` starts with "User" and ends with "successful".

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw 
| alter matches_user_login = wildcard_match(event_description, "User*successful") 
| fields event_id, event_description, matches_user_login 
| limit 2 

```

**Explanation**: The function returns `true` for event 101 because "User login successful" matches the pattern "User\*successful". The query returns `false` for event 102 because "File access attempt" does not match.

**Output:**

| event\_id | event\_description      | matches\_user\_login |
| --------- | ----------------------- | -------------------- |
| 101       | "User login successful" | true                 |
| 102       | "File access attempt"   | false                |

### Example 2: Wildcard matching with `?`

**Goal**: Use the `?` wildcard to match exactly one character within the `raw_log_data` field, targeting a specific process name pattern like "c?d.exe".

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw 
| alter matches_cmd_pattern = wildcard_match(raw_log_data, "Process c?d.exe*") 
| fields event_id, raw_log_data, matches_cmd_pattern 
| limit 2 

```

**Explanation**: For event 102, the string "Process cmd.exe..." matches the pattern because the 'm' in "cmd" is a single character matched by `?`. Event 101 does not match the pattern.

**Output:**

| event\_id | raw\_log\_data                                    | matches\_cmd\_pattern |
| --------- | ------------------------------------------------- | --------------------- |
| 101       | "User Alice logged in from 192.168.1.10"          | false                 |
| 102       | "Process cmd.exe attempted to access /etc/passwd" | true                  |

### Example 3: Complex pattern with `*` and `?`

**Goal**: Combine both wildcards to match a complex file path pattern in `raw_log_data`.

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw 
| alter matches_complex_pattern = wildcard_match(raw_log_data, "*cmd.ex? attempted to access /*/passw?d") 
| fields event_id, raw_log_data, matches_complex_pattern 
| limit 2 

```

**Explanation**: The pattern uses `*` to match variable segments ("Process " and "tc/") and `?` to match specific single characters ('e' in exe and 'd' in passwd). This correctly identifies event 102 as a match.

**Output:**

| event\_id | raw\_log\_data                                    | matches\_complex\_pattern |
| --------- | ------------------------------------------------- | ------------------------- |
| 101       | "User Alice logged in from 192.168.1.10"          | false                     |
| 102       | "Process cmd.exe attempted to access /etc/passwd" | true                      |

### Example 4: Case-insensitive matching

**Goal**: Perform a case-insensitive check on `event_description` using the `(?i)` flag.

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw 
| alter matches_case_insensitive = wildcard_match(event_description, "(?i)user*login*successful") 
| fields event_id, event_description, matches_case_insensitive 
| limit 2 

```

**Explanation**: Even though `event_description` starts with an uppercase "User" and the pattern specifies "user", the `(?i)` flag enables case-insensitive matching, resulting in `true` for event 101.

**Output:**

| event\_id | event\_description      | matches\_case\_insensitive |
| --------- | ----------------------- | -------------------------- |
| 101       | "User login successful" | true                       |
| 102       | "File access attempt"   | false                      |

## Related articles

* **Stages**: [`alter`](/xql-command-reference-guide/readme/stages/alter.md), [`filter`](/xql-command-reference-guide/readme/stages/filter.md)
* **Functions**: [`replex`](/xql-command-reference-guide/readme/functions/replex.md), [`replace`](/xql-command-reference-guide/readme/functions/replace.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/wildcard_match.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.