Skip to main content


This Script is part of the Filters And Transformers Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.9.0 and later.

This filter accepts two inputs, left and right, each of which can be either a single element of any type (e.g., string, int, etc.) or a list of elements. The filter iterates over each element in the left input and returns all elements that have a substring that is equal to an element from the right side. The matching process is case-insensitive, meaning it disregards letter case during the comparison.

All inputs are treated either as a string or as a list of strings, if it contains a comma. A JSON is always treated as a string.

Since the comparison treats all inputs as strings, integers and strings are considered equal during the evaluation.

Script Data#

Script Typepython3
Cortex XSOAR Version6.9.0


Argument NameDescription
leftValue to check if it has a substring that is equal to an element in the right side. Can be a single value or a comma-separated list.
rightValue to check if it is equal to an element or to a substring of an element from the left. Can be a single value or a comma-separated list.


There are no outputs for this script.

Table of examples#

1,2,3"1"1Integers are treated as strings.
1,2,25025,10250A part of 250 exists in the right side.
bcaAbcaThe filter is case-insensitive.
{'alert' {'data': 'x'}}x{'alert' {'data': 'x'}}
{'a':1},{'b':2}{'a':1,'c':2}None{'a':1,'c':2} is nat a part of a value from the left.
{'a':1},{'b':2}{a:1}None{a:1} is not a part of any value from the left.
{key1:value1, key2:value2}1{key1:value1, key2:value2}A json is treated as a single string, even when there is a comma in it.
'','{'a':1,'c':2}''' is not a part of {'a':1,'c':2}, but ' is.