Skip to main content

ExtFilter

Filter values with complex conditions.
You can make filters with comlex and combination conditions for the context data at any level of the tree.

Script Data#

NameDescription
Script Typepython
Tagstransformer, entirelist, general

Inputs#

Argument NameDescription
valueThe value to filter/transform.
operatorThe operation name to filter/transform.
filterThe filter.
ctx_demistoEnable to access the context data
ctx_inputsEnable to access the input parameters to sub playbooks and use ${inputs.}
ctx_listsEnable to access the list data and use ${list.}
ctx_incidentEnable to access the incident context and use ${incident.}

Filter Syntax for expressions, conditions and transformers#

primitive-expression ::= <operator> : <value>
dict-expression ::= SET OF primitive-expression
array-expression ::= ARRAY OF ( dict-expression | array-expression | "not" expressions | "or" expressions | "and" expressions )
expressions ::= dict-expression | array-expression
primitive-condition ::= <path> : expressions
condition ::= SET OF primitive-condition
array-condition ::= ARRAY OF condition
conditions ::= condition | array-condition
transformers ::= dict-expression | ARRAY OF dict-expression

dict-expression#

and logical operator for each expression.

e.g.

(<value> ends with ".exe") && (<value> starts with "x")

{
"ends with" : ".exe",
"starts with": "x"
}

array-expression#

Logical operations for each expression. and by default.

e.g.

(<value> ends with ".exe") && (<value> starts with "x")

[
{"ends with" : ".exe"},
"and",
{"starts with": "x"}
]

or

[
{"ends with" : ".exe"},
{"starts with": "x"}
]

(<value> ends with ".exe") || (<value> starts with "x")

[
{"ends with" : ".exe"},
"or",
{"starts with": "x"}
]

not (<value> ends with ".exe")

[
"not",
{"ends with" : ".exe"}
]

((<value> ends with ".exe") || (<value> ends with ".pdf")) and (<value> starts with "x")

[
[
{"ends with" : ".exe"},
"or",
{"ends with" : ".pdf"}
],
"and",
{"starts with": "x"}
]

condition#

Evaluates child nodes of each dictionary element.

e.g.

<value>.Domain ends with ".com"

{
"Domain": {
"ends with" : ".com"
}
}

(<value>.Domain ends with ".com") && (<value>.IP starts with "192.168.")

{
"Domain": {
"ends with" : ".com"
},
"IP": {
"starts with" : "192.168."
}
}

array-condition#

Logical operations for each condition. and by default.

e.g.

(<value>.Domain ends with ".com") || (<value>.IP starts with "192.168.")

[
{
"Domain": {
"ends with" : ".com"
}
}
"or",
{
"IP": {
"starts with" : "192.168."
}
}
]

not ((<value>.Domain ends with ".com") || (<value>.IP starts with "192.168."))

[
"not",
[
{
"Domain": {
"ends with" : ".com"
}
}
"or",
{
"IP": {
"starts with" : "192.168."
}
}
]
]

transformers#

Run each transformer in order.

e.g.

base64: encode -> digest

[
{"base64: encode": {}},
{"digest": {"algorithm": "sha1"}}
]

base64: encode -> digest (Python 3.7 or above)

{
"base64: encode": {},
"digest": {"algorithm": "sha1"}
}

Note: The order depends on python runtime in a dict-expression. Python 3.6 or less doesn't guarantee dictionary keys order.

DT (Demisto Transform Language)#

In filters written in JSON like expressions, conditions, transformers or <value>, you can set values with DT expressions for keys and values. When you use DT, you must set ctx_demisto, ctx_inputs, ctx_lists and ctx_incident of the parameters for the data to which DT accesses.

ParameterData SourceValueDescription
ctx_demistoFrom Previous Tasks.Enable to access the context data
ctx_inputsFrom Previous TasksinputsEnable to access the input parameters to sub playbooks and use ${inputs.}
ctx_listsFrom Previous TaskslistEnable to access the list data and use ${list.}
ctx_incidentFrom Previous TasksincidentEnable to access the incident context and use ${incident.}

NOTE: ${list.} doesn't work in XSOAR 6.0 in transformer.

local prefix (${local.}) and . prefix (${..}) can be available for additional DT references.
${local} refers the root value of the target, and ${local.<name>} refers the value property located at the relateve path to the root.
${..} refers the current value of the target, and ${.<name>} refers the value property located at the relateve path to the current value.
No parameters set is required for using ${local.} and ${..}.

Example 1#

{
"ends with": "${Extension}"
}

Example 2#

{
"${KeyName}": {
"ends with": "${Extension}"
}
}

Example 3#

{
"ends with": "${Name}.exe"
}

Example 4#

{
"ends with": "${.=val.Extension}"
}

Example 5#

{
"ends with": "${incident.name}"
}

Example 6#

{
"ends with": "${local.Extension}"
}

Operators#

Available operators

  • is transformed with
  • is filtered with
  • value is filtered with
  • keeps
  • doesn't keep
  • is
  • isn't
  • ===
  • !==
  • equals
  • ==
  • doesn't equal
  • !=
  • greater or equal
  • >=
  • greater than
  • >
  • less or equal
  • <=
  • less than
  • in range
  • starts with
  • starts with caseless
  • doesn't start with
  • doesn't start with caseless
  • ends with
  • ends with caseless
  • doesn't end with
  • doesn't end with caseless
  • includes
  • includes caseless
  • doesn't include
  • doesn't include caseless
  • finds
  • finds caseless
  • doesn't find
  • doesn't find caseless
  • matches
  • matches caseless
  • doesn't match
  • doesn't match caseless
  • wildcard: matches
  • wildcard: matches caseless
  • wildcard: doesn't match
  • wildcard: doesn't match caseless
  • regex: matches
  • regex: matches caseless
  • regex: doesn't match
  • regex: doesn't match caseless
  • in list
  • in caseless list
  • not in list
  • not in caseless list
  • contains
  • contains caseless
  • doesn't contain
  • doesn't contain caseless
  • wildcard: contains
  • wildcard: contains caseless
  • wildcard: doesn't contain
  • wildcard: doesn't contain caseless
  • regex: contains
  • regex: contains caseless
  • regex: doesn't contain
  • regex: doesn't contain caseless
  • matches any line of
  • matches any caseless line of
  • doesn't match any line of
  • doesn't match any caseless line of
  • matches any string of
  • matches any caseless string of
  • doesn't match any string of
  • doesn't match any caseless string of
  • wildcard: matches any string of
  • wildcard: matches any caseless string of
  • wildcard: doesn't match any string of
  • wildcard: doesn't match any caseless string of
  • regex: matches any string of
  • regex: matches any caseless string of
  • regex: doesn't match any string of
  • regex: doesn't match any caseless string of
  • contains any line of
  • contains any caseless line of
  • doesn't contain any line of
  • doesn't contain any caseless line of
  • contains any string of
  • contains any caseless line of
  • doesn't contain any string of
  • doesn't contain any caseless line of
  • wildcard: contains any string of
  • wildcard: contains any caseless line of
  • wildcard: doesn't contain any string of
  • wildcard: doesn't contain any caseless line of
  • regex: contains any string of
  • regex: contains any caseless line of
  • regex: doesn't contain any string of
  • regex: doesn't contain any caseless line of
  • matches expressions of
  • matches conditions of
  • value matches expressions of
  • value matches conditions of
  • json: encode array
  • json: encode
  • json: decode
  • base64: encode
  • base64: decode
  • digest
  • is replaced with
  • is updated with
  • appends
  • if-then-else
  • switch-case
  • collects values
  • collects keys
  • flattens with values
  • flattens with keys
  • abort
  • email-header: decode
  • regex: replace
  • is individually transformed with
  • is collectively transformed with

Operator: is transformed with#

Transforms elements with `transformers` given in a filter. See `Filter Syntax` for the details of `transformers`.

Filter Format: transformers

Example 1#

Input#
[
{
"Name": "a.dat",
"Size": 100
},
{
"Name": "b.exe",
"Size": 200
},
{
"Name": "c.txt",
"Size": 300
}
]
Filter#

Operator: is transformed with

Path:

Filter:

{
"json: encode": {},
"base64: encode": {}
}
Output#
[
"eyJOYW1lIjogImEuZGF0IiwgIlNpemUiOiAxMDB9",
"eyJOYW1lIjogImIuZXhlIiwgIlNpemUiOiAyMDB9",
"eyJOYW1lIjogImMudHh0IiwgIlNpemUiOiAzMDB9"
]

Example 2#

Input#
{
"File": [
{
"Name": "a.dat",
"Size": 100
},
{
"Name": "b.exe",
"Size": 200
}
],
"IP": [
"1.1.1.1",
"2.2.2.2"
]
}
Filter#

Operator: is transformed with

Path: File

Filter:

{
"is filtered with": {
"Name": {
"ends with": ".exe"
}
},
"json: encode": {},
"base64: encode": {}
}
Output#
{
"File": [
"eyJOYW1lIjogImIuZXhlIiwgIlNpemUiOiAyMDB9"
],
"IP": [
"1.1.1.1",
"2.2.2.2"
]
}

Example 3#

Input#
[
{
"Name": "a.dat",
"Size": 100
},
{
"Name": "b.exe",
"Size": 200
}
]
Filter#

Operator: is transformed with

Path:

Filter:

{
"is replaced with": {
"User": "JDOE"
}
}
Output#
[
{
"User": "JDOE"
}
]

Operator: is filtered with#

Evaluates each element of an array with given conditions and returns a set of the elements matched. The value is handled as an array which has only one element when its data type is `dictionary`. See `Filter Syntax` for the details of `conditions`.

Filter Format: conditions

Example 1#

Input#
[
{
"Name": "a.dat",
"Size": 100
},
{
"Name": "b.exe",
"Size": 200
},
{
"Name": "c.txt",
"Size": 300
}
]
Filter#

Operator: is filtered with

Path: Name

Filter:

{
"Name": {
"ends with": ".exe"
}
}
Output#
[
{
"Name": "b.exe",
"Size": 200
}
]

Operator: value is filtered with#

Evaluates each value of dictionary elements or each element for values whose data type is not `dictionary`, and returns a set of the elements matched to expressions given in a filter. See `Filter Syntax` for the details of `expressions`.

Filter Format: expressions

Example 1#

Input#
[
"192.168.1.1",
"1.1.1.1",
"192.168.1.2"
]
Filter#

Operator: value is filtered with

Path:

Filter:

{
"starts with": "192.168."
}
Output#
[
"192.168.1.1",
"192.168.1.2"
]

Example 2#

Input#
{
"Host1": {
"User": "JDOE",
"IP": "192.168.1.1",
"Score": 30
},
"Host2": {
"User": "TYAMADA",
"IP": "192.168.1.2",
"Score": 10
},
"Host3": {
"User": "MBLACK",
"IP": "3.3.3.3",
"Score": 40
}
}
Filter#

Operator: value is filtered with

Path: Score

Filter:

{
">=": 20
}
Output#
{
"Host1": {
"User": "JDOE",
"IP": "192.168.1.1",
"Score": 30
},
"Host3": {
"User": "MBLACK",
"IP": "3.3.3.3",
"Score": 40
}
}

Operator: keeps#

Evaluates each element of an array with keys given and returns a set of the elements which only retains the keys given and corresponding values. The value is handled as an array which has only one element when its data type is `dictionary`.

Filter Format: expressions

Example 1#

Input#
[
{
"Host": "JDOE",
"IP": "1.1.1.1"
},
{
"User": "John Doe",
"First Name": "John",
"Last Name": "Doe"
},
{
"Host": "YTARO",
"User": "Taro Yamada"
}
]
Filter#

Operator: keeps

Path:

Filter:

[
"Host",
"User"
]
Output#
[
{
"Host": "JDOE"
},
{
"User": "John Doe"
},
{
"Host": "YTARO",
"User": "Taro Yamada"
}
]

Operator: doesn't keeps#

Evaluates each element of an array with keys given and returns a set of the elements which are excluded the keys given. The value is handled as an array which has only one element when its data type is `dictionary`.

Filter Format: expressions

Example 1#

Input#
[
{
"Host": "JDOE",
"IP": "1.1.1.1"
},
{
"User": "John Doe",
"First Name": "John",
"Last Name": "Doe"
},
{
"Host": "YTARO",
"User": "Taro Yamada"
}
]
Filter#

Operator: doesn't keeps

Path:

Filter:

[
"Host",
"User"
]
Output#
[
{
"IP": "1.1.1.1"
},
{
"First Name": "John",
"Last Name": "Doe"
},
},
{
}
]

Operator: is#

This operator works with a sub operator specified as filter.

Sub Operator: empty#

Returns a set of elements which is empty.

Example 1#

Input#
10
Filter#

Operator: is

Path:

Filter:

empty
Output#
null

Example 2#

Input#
[
10,
{
},
null,
"xxx"
]
Filter#

Operator: is

Path:

Filter:

empty
Output#
[
{
},
null
]

Sub Operator: null#

Returns a set of elements which is `null`.

Example 1#

Input#
10
Filter#

Operator: is

Path:

Filter:

null
Output#
null

Example 2#

Input#
[
10,
{
},
null,
"xxx"
]
Filter#

Operator: is

Path:

Filter:

null
Output#
[
null
]

Sub Operator: string#

Returns a set of elements whose data type is `string`.

Example 1#

Input#
10
Filter#

Operator: is

Path:

Filter:

string
Output#
null

Example 2#

Input#
[
10,
{
},
null,
"xxx"
]
Filter#

Operator: is

Path:

Filter:

string
Output#
[
"xxx"
]

Sub Operator: integer#

Returns a set of elements whose data type is `integer`.

Example 1#

Input#
10
Filter#

Operator: is

Path:

Filter:

integer
Output#
10

Example 2#

Input#
[
10,
"123"
]
Filter#

Operator: is

Path:

Filter:

integer
Output#
[
10
]

Sub Operator: integer string#

Returns a set of elements whose data type is `string` and whose value is integer. The value that includes decimal point is evaluated as not integer.

Example 1#

Input#
[
10,
"123"
]
Filter#

Operator: is

Path:

Filter:

integer string
Output#
[
"123"
]

Sub Operator: any integer#

Returns a set of elements matched with `string` or `integer string` operator.

Example 1#

Input#
[
10,
"123",
"xxx"
]
Filter#

Operator: is

Path:

Filter:

any integer
Output#
[
10,
"123"
]

Sub Operator: existing key#

Evaluates each dictionary element of an array, then returns a set of the elements which has a key given in `path`.

Example 1#

Input#
[
{
"Host": "JDOE",
"IP": "1.1.1.1"
},
{
"User": "John Doe",
"Email": "jdoe@domain.com"
}
]
Filter#

Operator: is

Path: Host

Filter:

existing key
Output#
[
{
"Host": "JDOE",
"IP": "1.1.1.1"
}
]

Example 2#

Input#
[
{
"Host": {
"IP": "1.1.1.1",
"Score": 50,
"User": "JDOE"
},
"User": {
"ID": 1000,
"Name": "John Doe"
}
},
{
"Host": {
"IP": "2.2.2.2",
"Score": 30
}
}
]
Filter#

Operator: is

Path: Host.User

Filter:

existing key
Output#
[
{
"Host": {
"IP": "1.1.1.1",
"Score": 50,
"User": "JDOE"
},
"User": {
"ID": 1000,
"Name": "John Doe"
}
}
]

Operator: isn't#

This operator works with a sub operator specified as filter.

Sub Operator: empty#

Returns a set of elements which is not empty.

Example 1#

Input#
10
Filter#

Operator: isn't

Path:

Filter:

empty
Output#
10

Example 2#

Input#
[
10,
{
},
null,
"xxx"
]
Filter#

Operator: isn't

Path:

Filter:

empty
Output#
[
10,
"xxx"
]

Sub Operator: null#

Returns a set of elements which is not `null`.

Example 1#

Input#
10
Filter#

Operator: isn't

Path:

Filter:

10
Output#
null

Example 2#

Input#
[
10,
{
},
null,
"xxx"
]
Filter#

Operator: isn't

Path:

Filter:

null
Output#
[
10,
{
},
"xxx"
]

Sub Operator: string#

Returns a set of elements whose data type is not `string`.

Example 1#

Input#
10
Filter#

Operator: isn't

Path:

Filter:

string
Output#
10

Example 2#

Input#
[
10,
{
},
null,
"xxx"
]
Filter#

Operator: isn't

Path:

Filter:

string
Output#
[
10,
{
},
null
]

Sub Operator: integer#

Returns a set of elements whose date type is not `integer`.

Example 1#

Input#
10
Filter#

Operator: isn't

Path:

Filter:

integer
Output#
null

Example 2#

Input#
[
10,
"123"
]
Filter#

Operator: isn't

Path:

Filter:

integer
Output#
[
"123"
]

Sub Operator: integer string#

Returns a set of elements whose data type is not `string` or whose value is not integer. The value that includes decimal point is evaluated as not integer.

Example 1#

Input#
[
10,
"123",
"123.0"
]
Filter#

Operator: isn't

Path:

Filter:

integer string
Output#
[
10,
"123.0"
]

Sub Operator: any integer#

Returns a set of elements which are neither `string` or `integer string`.

Example 1#

Input#
[
10,
"123",
"xxx"
]
Filter#

Operator: isn't

Path:

Filter:

any integer
Output#
[
"xxx"
]

Sub Operator: existing key#

Evaluates each dictionary element of an array, then returns a set of the elements which doesn't have a key given in `path`.

Example 1#

Input#
[
{
"Host": "JDOE",
"IP": "1.1.1.1"
},
{
"User": "John Doe",
"Email": "jdoe@domain.com"
}
]
Filter#

Operator: isn't

Path: Host

Filter:

existing key
Output#
[
{
"User": "John Doe",
"Email": "jdoe@domain.com"
}
]

Example 2#

Input#
[
{
"Host": {
"IP": "1.1.1.1",
"Score": 50,
"User": "JDOE"
},
"User": {
"ID": 1000,
"Name": "John Doe"
}
},
{
"Host": {
"IP": "2.2.2.2",
"Score": 30
}
}
]
Filter#

Operator: isn't

Path: Host.User

Filter:

existing key
Output#
[
{
"Host": {
"IP": "2.2.2.2",
"Score": 30
}
}
]

Operator: ===#

Returns a set of elements which exactly matches to a value given in a filter. It doesn't match when the data types are different.

Filter Format: <value>

Example 1#

Input#
[
10,
"10",
123
]
Filter#

Operator: ===

Path:

Filter:

10
Output#
[
10
]

Example 2#

Input#
[
10,
"10",
123
]
Filter#

Operator: ===

Path:

Filter:

"10"
Output#
[
"10"
]

Operator: !==#

Returns a set of elements which doesn't match the data type or the value of a value given in a filter.

Filter Format: <value>

Example 1#

Input#
[
10,
"10",
123
]
Filter#

Operator: !==

Path:

Filter:

10
Output#
[
"10",
123
]

Operator: equals, ==#

Returns a set of elements which is equal to a value given in a filter. The value is implicitly converted from its data type to another in a comparison between different data types. `==` is an alias name for `equals`.

Filter Format: <value>

Example 1#

Input#
[
10,
"10",
123
]
Filter#

Operator: equals

Path:

Filter:

10
Output#
[
10,
"10"
]

Operator: doesn't equal, !=#

Returns a set of elements which is not equal to a value given in a filter. The value is implicitly converted from its data type to another in a comparison between different data types. `!=` is an alias name for `doesn't equal`.

Filter Format: <value>

Example 1#

Input#
[
10,
"10",
123
]
Filter#

Operator: doesn't equal

Path:

Filter:

10
Output#
[
123
]

Operator: greater or equal, >=#

Returns a set of elements which is greater or equal to a value given in a filter. The value is implicitly converted from its data type to number in a comparison. This operator evaluates to false for either or both of the data which cannot convert to number. `>=` is an alias name for `greater or equal`.

Filter Format: <value>

Example 1#

Input#
[
1,
10,
"10",
123
]
Filter#

Operator: greater or equal

Path:

Filter:

10
Output#
[
10,
"10",
123
]

Operator: greater than, >#

Returns a set of elements which is greater than a value given in a filter. The value is implicitly converted from its data type to number in a comparison. This operator evaluates to false for either or both of the data which cannot convert to number. `>` is an alias name for `greater than`.

Filter Format: <value>

Example 1#

Input#
[
1,
10,
"10",
123
]
Filter#

Operator: greater than

Path:

Filter:

10
Output#
[
123
]

Operator: less or equal, &lt;=#

Returns a set of elements which is less or equal to a value given in a filter. The value is implicitly converted from its data type to number in a comparison. This operator evaluates to false for either or both of the data which cannot convert to number. `<=` is an alias name for `less or equal`.

Filter Format: <value>

Example 1#

Input#
[
1,
10,
"10",
123
]
Filter#

Operator: less or equal

Path:

Filter:

10
Output#
[
1,
10,
"10"
]

Operator: less than, <#

Returns a set of elements which is less than a value given in a filter. The value is implicitly converted from its data type to number in a comparison. This operator evaluates to false for either or both of the data which cannot convert to number. `<` is an alias name for `less than`.

Filter Format: <value>

Example 1#

Input#
[
1,
10,
"10",
123
]
Filter#

Operator: less than

Path:

Filter:

10
Output#
[
1
]

Operator: in range#

Returns a set of elements which is greater or equal to `min` and less or equal to `max` given in a range. The value is implicitly converted from its data type to number in a comparison. This operator evaluates to false for either or both of the data which cannot convert to number.

Filter Format: min,max

Example 1#

Input#
[
1,
10,
"10",
"30",
123
]
Filter#

Operator: in range

Path:

Filter:

10,100
Output#
[
10,
"10",
"30"
]

Operator: starts with#

Returns a set of elements which starts with a string given in a filter.

Filter Format: string

Example 1#

Input#
[
10,
"xxx.exe",
"yyy.pdf",
{
"xxx": "x"
}
]
Filter#

Operator: starts with

Path:

Filter:

xxx
Output#
[
"xxx.exe"
]

Operator: starts with caseless#

Returns a set of elements which starts with a string given in a filter. It performs case-insensitive matching.

Filter Format: string

Example 1#

Input#
[
10,
"xxx.exe",
"XXX.EXE",
"yyy.pdf",
{
"xxx": "x"
}
]
Filter#

Operator: starts with caseless

Path:

Filter:

xxx
Output#
[
"xxx.exe",
"XXX.EXE"
]

Operator: doesn't start with#

Returns a set of elements which doesn't start with a string given in a filter.

Filter Format: string

Example 1#

Input#
[
10,
"xxx.exe",
"yyy.pdf",
{
"xxx": "x"
}
]
Filter#

Operator: doesn't start with

Path:

Filter:

xxx
Output#
[
10,
"yyy.pdf",
{
"xxx": "x"
}
]

Operator: doesn't start with caseless#

Returns a set of elements which doesn't start with a string given in a filter. It performs case-insensitive matching.

Filter Format: string

Example 1#

Input#
[
10,
"xxx.exe",
"XXX.EXE",
"yyy.pdf",
{
"xxx": "x"
}
]
Filter#

Operator: doesn't start with caseless

Path:

Filter:

xxx
Output#
[
10,
"yyy.pdf",
{
"xxx": "x"
}
]

Operator: ends with caseless#

Returns a set of elements which ends with a string given in a filter. It performs case-insensitive matching.

Filter Format: string

Example 1#

Input#
[
10,
"xxx.exe",
"XXX.EXE",
"yyy.pdf",
{
"xxx": "x"
}
]
Filter#

Operator: ends with caseless

Path:

Filter:

.exe
Output#
[
"xxx.exe",
"XXX.EXE"
]

Operator: doesn't end with#

Returns a set of elements which doesn't end with a string given in a filter.

Filter Format: string

Example 1#

Input#
[
10,
"xxx.exe",
"yyy.pdf",
{
"xxx": "x"
}
]
Filter#

Operator: doesn't end with

Path:

Filter:

.exe
Output#
[
10,
"yyy.pdf",
{
"xxx": "x"
}
]

Operator: doesn't end with caseless#

Returns a set of elements which doesn't end with a string given in a filter. It performs case-insensitive matching.

Filter Format: string

Example 1#

Input#
[
10,
"xxx.exe",
"XXX.EXE",
"yyy.pdf",
{
"xxx": "x"
}
]
Filter#

Operator: doesn't end with caseless

Path:

Filter:

.exe
Output#
[
10,
"yyy.pdf",
{
"xxx": "x"
}
]

Operator: includes#

Returns a set of elements of which a string given in a filter is a substring. The searching only works for `string` data types. It evaluates to unmatched for a element that either or both of the data types is not `string`.

Filter Format: string

Example 1#

Input#
www.paloaltonetworks.com
Filter#

Operator: includes

Path:

Filter:

paloaltonetworks
Output#
www.paloaltonetworks.com

Example 2#

Input#
[
10,
"www.paloaltonetworks.com",
"www.paloaltonetworks.co.jp",
{
"xxx": "xxx.paloaltonetworks.com"
}
]
Filter#

Operator: includes

Path:

Filter:

paloaltonetworks
Output#
[
"www.paloaltonetworks.com",
"www.paloaltonetworks.co.jp"
]

Operator: includes caseless#

Returns a set of elements of which a string given in a filter is a substring. It performs case-insensitive seaching, and only works for `string` data types. It evaluates to unmatched for a element that either or both of the data types is not `string`.

Filter Format: string

Example 1#

Input#
[
10,
"www.paloaltonetworks.com",
"WWW.PaloAltoNetworks.COM",
{
"xxx": "xxx.paloaltonetworks.com"
}
]
Filter#

Operator: includes caseless

Path:

Filter:

paloaltonetworks
Output#
[
"www.paloaltonetworks.com",
"WWW.PaloAltoNetworks.COM"
]

Operator: doesn't include#

Returns a set of elements of which a string given in a filter is not a substring. The searching only works for `string` data types. It evaluates to unmatched for a element that either or both of the data types is not `string`.

Filter Format: string

Example 1#

Input#
[
10,
"www.paloaltonetworks.com",
"www.paloaltonetworks.co.jp",
{
"xxx": "xxx.paloaltonetworks.com"
}
]
Filter#

Operator: doesn't include

Path:

Filter:

paloaltonetworks
Output#
[
10,
{
"xxx": "xxx.paloaltonetworks.com"
}
]

Operator: doesn't include caseless#

Returns a set of elements of which a string given in a filter is not a substring. It performs case-insensitive seaching, and only works for `string` data types. It evaluates to unmatched for a element that either or both of the data types is not `string`.

Filter Format: string

Example 1#

Input#
[
10,
"www.paloaltonetworks.com",
"WWW.PaloAltoNetworks.COM",
{
"xxx": "xxx.paloaltonetworks.com"
}
]
Filter#

Operator: doesn't include caseless

Path:

Filter:

paloaltonetworks
Output#
[
10,
{
"xxx": "xxx.paloaltonetworks.com"
}
]

Operator: finds#

Returns the entire target value if a string given in a filter is a substring of any of the elements, `null` otherwise. The searching is performed for a single `string` element or each `string` element of an array.

Filter Format: string

Example 1#

Input#
www.paloaltonetworks.com
Filter#

Operator: finds

Path:

Filter:

paloaltonetworks
Output#
www.paloaltonetworks.com

Example 2#

Input#
[
10,
"www.paloaltonetworks.com",
"WWW.PaloAltoNetworks.COM",
{
"xxx": "xxx.paloaltonetworks.com"
}
]
Filter#

Operator: finds

Path:

Filter:

paloaltonetworks
Output#
[
10,
"www.paloaltonetworks.com",
"WWW.PaloAltoNetworks.COM",
{
"xxx": "xxx.paloaltonetworks.com"
}
]

Example 3#

Input#
[
10,
"www.paloaltonetworks.com",
"WWW.PaloAltoNetworks.COM",
{
"xxx": "xxx.paloaltonetworks.com"
}
]
Filter#

Operator: finds

Path:

Filter:

xxx.paloaltonetworks.com
Output#
null

Operator: finds caseless#

Returns the entire target value if a string given in a filter is a substring of any of the elements, `null` otherwise. The searching is performed for a single `string` element or each `string` element of an array with case-insensitive matching.

Filter Format: string

Example 1#

Input#
WWW.PaloAltoNetworks.COM
Filter#

Operator: finds caseless

Path:

Filter:

paloaltonetworks
Output#
WWW.PaloAltoNetworks.COM

Example 2#

Input#
[
10,
"WWW.PaloAltoNetworks.COM",
{
"xxx": "xxx.paloaltonetworks.com"
}
]
Filter#

Operator: finds caseless

Path:

Filter:

paloaltonetworks
Output#
[
10,
"WWW.PaloAltoNetworks.COM",
{
"xxx": "xxx.paloaltonetworks.com"
}
]

Operator: doesn't find#

Returns an entire target value if a string given in a filter is not a substring of any of the elements, `null` otherwise. The searching is performed for a single `string` element or each `string` element of an array.

Filter Format: string

Example 1#

Input#
www.paloaltonetworks.com
Filter#

Operator: doesn't find

Path:

Filter:

paloaltonetworks
Output#
null

Example 2#

Input#
[
10,
"www.paloaltonetworks.com",
"WWW.PaloAltoNetworks.COM",
{
"xxx": "xxx.paloaltonetworks.com"
}
]
Filter#

Operator: doesn't find

Path:

Filter:

paloaltonetworks
Output#
null

Example 3#

Input#
[
10,
"www.paloaltonetworks.com",
"WWW.PaloAltoNetworks.COM",
{
"xxx": "xxx.paloaltonetworks.com"
}
]
Filter#

Operator: doesn't find

Path:

Filter:

xxx.paloaltonetworks
Output#
[
10,
"www.paloaltonetworks.com",
"WWW.PaloAltoNetworks.COM",
{
"xxx": "xxx.paloaltonetworks.com"
}
]

Operator: doesn't find caseless#

Returns an entire target value if a string given in a filter is not a substring of any of the elements, `null` otherwise. The searching is performed for a single `string` element or each `string` element of an array with case-insensitive matching.

Filter Format: string

Example 1#

Input#
WWW.PaloAltoNetworks.COM
Filter#

Operator: doesn't find caseless

Path:

Filter:

PaloAltoNetworks
Output#
null

Example 2#

Input#
[
10,
"WWW.PaloAltoNetworks.COM",
{
"xxx": "xxx.paloaltonetworks.com"
}
]
Filter#

Operator: doesn't find caseless

Path:

Filter:

paloaltonetworks
Output#
null

Example 3#

Input#
[
10,
"WWW.PaloAltoNetworks.COM",
{
"xxx": "xxx.paloaltonetworks.com"
}
]
Filter#

Operator: doesn't find caseless

Path:

Filter:

xxx.paloaltonetworks
Output#
[
10,
"WWW.PaloAltoNetworks.COM",
{
"xxx": "xxx.paloaltonetworks.com"
}
]

Operator: matches#

Returns a set of elements which is equal to a string given in a filter. The matching is peformed between `string` data types. It doesn't match for a element whose data type is not `string`.

Filter Format: string

Example 1#

Input#
www.paloaltonetworks.com
Filter#

Operator: matches

Path:

Filter:

www.paloaltonetworks.com
Output#
www.paloaltonetworks.com

Example 2#

Input#
www.paloaltonetworks.com
Filter#

Operator: matches

Path:

Filter:

paloaltonetworks
Output#
null

Example 3#

Input#
[
"www.demisto.com",
"www.paloaltonetworks.com",
{
"Host": "www.paloaltonetworks.com"
}
]
Filter#

Operator: matches

Path:

Filter:

www.paloaltonetworks.com
Output#
[
"www.paloaltonetworks.com"
]

Operator: matches caseless#

Returns a set of elements which matches a string given in a filter. The matching is peformed case-insensitively and between `string` data types. It doesn't match for a element whose data type is not `string`.

Filter Format: string

Example 1#

Input#
WWW.PaloAltoNetworks.COM
Filter#

Operator: matches caseless

Path:

Filter:

www.paloaltonetworks.com
Output#
WWW.PaloAltoNetworks.COM

Example 2#

Input#
WWW.PaloAltoNetworks.COM
Filter#

Operator: matches caseless

Path:

Filter:

paloaltonetworks
Output#
null

Example 3#

Input#
[
"www.demisto.com",
"WWW.PaloAltoNetworks.COM",
{
"Host": "www.paloaltonetworks.com"
}
]
Filter#

Operator: matches caseless

Path:

Filter:

www.paloaltonetworks.com
Output#
[
"WWW.PaloAltoNetworks.COM"
]

Operator: doesn't match#

Returns a set of elements which is not equal to a string given in a filter. The matching is peformed between `string` data types. It doesn't match for a element whose data type is not `string`.

Filter Format: string

Example 1#

Input#
www.paloaltonetworks.com
Filter#

Operator: doesn't match

Path:

Filter:

www.paloaltonetworks.com
Output#
null

Example 2#

Input#
www.paloaltonetworks.com
Filter#

Operator: doesn't match

Path:

Filter:

paloaltonetworks
Output#
www.paloaltonetworks.com

Example 3#

Input#
[
"www.demisto.com",
"www.paloaltonetworks.com",
{
"Host": "www.paloaltonetworks.com"
}
]
Filter#

Operator: doesn't match

Path:

Filter:

www.paloaltonetworks.com
Output#
[
"www.demisto.com",
{
"Host": "www.paloaltonetworks.com"
}
]

Operator: doesn't match caseless#

Returns a set of elements which doesn't match a string given in a filter. The matching is peformed case-insensitively and between `string` data types. It doesn't match for a element whose data type is not `string`.

Filter Format: string

Example 1#

Input#
WWW.PaloAltoNetworks.COM
Filter#

Operator: doesn't match caseless

Path:

Filter:

www.paloaltonetworks.com
Output#
null

Example 2#

Input#
WWW.PaloAltoNetworks.COM
Filter#

Operator: doesn't match caseless

Path:

Filter:

paloaltonetworks
Output#
WWW.PaloAltoNetworks.COM

Example 3#

Input#
[
"www.demisto.com",
"WWW.PaloAltoNetworks.COM",
{
"Host": "www.paloaltonetworks.com"
}
]
Filter#

Operator: doesn't match caseless

Path:

Filter:

www.paloaltonetworks.com
Output#
[
"www.demisto.com",
{
"Host": "www.paloaltonetworks.com"
}
]

Operator: wildcard: matches#

Returns a set of elements which matches a wildcard pattern given in a filter. The matching is peformed between `string` data types. It doesn't match for a element whose data type is not `string`.

Filter Format: string

Example 1#

Input#
www.paloaltonetworks.com
Filter#

Operator: wildcard: matches

Path:

Filter:

???.paloaltonetworks.*
Output#
www.paloaltonetworks.com

Example 2#

Input#
[
"www.demisto.com",
"www.paloaltonetworks.com",
{
"Host": "www.paloaltonetworks.com"
}
]
Filter#

Operator: wildcard: matches

Path:

Filter:

???.paloaltonetworks.*
Output#
[
"www.paloaltonetworks.com"
]

Operator: wildcard: matches caseless#

Returns a set of elements which matches a wildcard pattern given in a filter. The matching is peformed case-insensitively and between `string` data types. It doesn't match for a element whose data type is not `string`.

Filter Format: string

Example 1#

Input#
WWW.PaloAltoNetworks.COM
Filter#

Operator: wildcard: matches caseless

Path:

Filter:

???.paloaltonetworks.*
Output#
WWW.PaloAltoNetworks.COM

Example 2#

Input#
[
"www.demisto.com",
"WWW.PaloAltoNetworks.COM",
{
"Host": "www.paloaltonetworks.com"
}
]
Filter#

Operator: wildcard: matches caseless

Path:

Filter:

???.paloaltonetworks.*
Output#
[
"WWW.PaloAltoNetworks.COM"
]

Operator: wildcard: doesn't match#

Returns a set of elements which doesn't match a wildcard pattern given in a filter. The matching is peformed between `string` data types. It doesn't match for a element whose data type is not `string`.

Filter Format: string

Example 1#

Input#
www.paloaltonetworks.com
Filter#

Operator: wildcard: doesn't match

Path:

Filter:

???.paloaltonetworks.*
Output#
null

Example 2#

Input#
[
"www.demisto.com",
"www.paloaltonetworks.com",
{
"Host": "www.paloaltonetworks.com"
}
]
Filter#

Operator: wildcard: doesn't match

Path:

Filter:

???.paloaltonetworks.*
Output#
[
"www.demisto.com",
{
"Host": "www.paloaltonetworks.com"
}
]

Operator: wildcard: doesn't match caseless#

Returns a set of elements which doesn't match a wildcard pattern given in a filter. The matching is peformed case-insensitively and between `string` data types. It doesn't match for a element whose data type is not `string`.

Filter Format: string

Example 1#

Input#
WWW.PaloAltoNetworks.COM
Filter#

Operator: wildcard: doesn't match caseless

Path:

Filter:

???.paloaltonetworks.*
Output#
null

Example 2#

Input#
[
"www.demisto.com",
"WWW.PaloAltoNetworks.COM",
{
"Host": "www.paloaltonetworks.com"
}
]
Filter#

Operator: wildcard: doesn't match caseless

Path:

Filter:

???.paloaltonetworks.*
Output#
[
"www.demisto.com",
{
"Host": "www.paloaltonetworks.com"
}
]

Operator: regex: matches#

Returns a set of elements which matches a regular expression pattern given in a filter. The matching is peformed between `string` data types. It doesn't match for a element whose data type is not `string`.

Filter Format: string

Example 1#

Input#
www.paloaltonetworks.com
Filter#

Operator: regex: matches

Path:

Filter:

.*paloaltonetworks.*
Output#
www.paloaltonetworks.com

Example 2#

Input#
[
"www.demisto.com",
"www.paloaltonetworks.com",
{
"Host": "www.paloaltonetworks.com"
}
]
Filter#

Operator: regex: matches

Path:

Filter:

.*paloaltonetworks.*
Output#
[
"www.paloaltonetworks.com"
]

Operator: regex: matches caseless#

Returns a set of elements which matches a regular expression pattern given in a filter. The matching is peformed case-insensitively and between `string` data types. It doesn't match for a element whose data type is not `string`.

Filter Format: string

Example 1#

Input#
WWW.PaloAltoNetworks.COM
Filter#

Operator: regex: matches caseless

Path:

Filter:

.*paloaltonetworks.*
Output#
WWW.PaloAltoNetworks.COM

Example 2#

Input#
[
"www.demisto.com",
"WWW.PaloAltoNetworks.COM",
{
"Host": "www.paloaltonetworks.com"
}
]
Filter#

Operator: regex: matches caseless

Path:

Filter:

.*paloaltonetworks.*
Output#
[
"WWW.PaloAltoNetworks.COM"
]

Operator: regex: doesn't match#

Returns a set of elements which doesn't match a regular expression pattern given in a filter. The matching is peformed between `string` data types. It doesn't match for a element whose data type is not `string`.

Filter Format: string

Example 1#

Input#
www.paloaltonetworks.com
Filter#

Operator: regex: doesn't match

Path:

Filter:

.*paloaltonetworks.*
Output#
null

Example 2#

Input#
[
"www.demisto.com",
"www.paloaltonetworks.com",
{
"Host": "www.paloaltonetworks.com"
}
]
Filter#

Operator: regex: doesn't match

Path:

Filter:

.*paloaltonetworks.*
Output#
[
"www.demisto.com",
{
"Host": "www.paloaltonetworks.com"
}
]

Operator: regex: doesn't match caseless#

Returns a set of elements which doesn't match a regular expression pattern given in a filter. The matching is peformed case-insensitively and between `string` data types. It doesn't match for a element whose data type is not `string`.

Filter Format: string

Example 1#

Input#
WWW.PaloAltoNetworks.COM
Filter#

Operator: regex: doesn't match caseless

Path:

Filter:

.*paloaltonetworks.*
Output#
null

Example 2#

Input#
[
"www.demisto.com",
"WWW.PaloAltoNetworks.COM",
{
"Host": "www.paloaltonetworks.com"
}
]
Filter#

Operator: regex: doesn't match caseless

Path:

Filter:

.*paloaltonetworks.*
Output#
[
"www.demisto.com",
{
"Host": "www.paloaltonetworks.com"
}
]

Operator: in list#

Returns a set of elements which matches any of strings of a comma separated list. The matching always evaluates to false for a element whose data type is not `string`.

Filter Format: string

Example 1#

Input#
banana
Filter#

Operator: in list

Path:

Filter:

apple,banana,cherry
Output#
banana

Example 2#

Input#
[
"apple",
"melon",
"banana",
{
"fruit": "orange"
}
]
Filter#

Operator: in list

Path:

Filter:

apple,banana,cherry
Output#
[
"apple",
"banana"
]

Operator: in caseless list#

Returns a set of elements which matches any of strings of a comma separated list. The matching is peformed case-insensitively, and always evaluates to false for a element whose data type is not `string`.

Filter Format: string

Example 1#

Input#
Banana
Filter#

Operator: in caseless list

Path:

Filter:

apple,banana,cherry
Output#
Banana

Example 2#

Input#
[
"Apple",
"Melon",
"Banana",
{
"Fruit": "Orange"
}
]
Filter#

Operator: in caseless list

Path:

Filter:

apple,banana,cherry
Output#
[
"Apple",
"Banana"
]

Operator: not in list#

Returns a set of elements which doesn't match any of strings of a comma separated list. The matching always evaluates to false for a element whose data type is not `string`.

Filter Format: string

Example 1#

Input#
melon
Filter#

Operator: not in list

Path:

Filter:

apple,banana,cherry
Output#
melon

Example 2#

Input#
banana
Filter#

Operator: not in list

Path:

Filter:

apple,banana,cherry
Output#
null

Example 3#

Input#
[
"apple",
"melon",
"banana",
{
"fruit": "orange"
}
]
Filter#

Operator: not in list

Path:

Filter:

apple,banana,cherry
Output#
[
"melon",
{
"fruit": "orange"
}
]

Operator: not in caseless list#

Returns a set of elements which doesn't match any of strings of a comma separated list. The matching is peformed case-insensitively, and always evaluates to false for a element whose data type is not `string`.

Filter Format: string

Example 1#

Input#
Melon
Filter#

Operator: not in caseless list

Path:

Filter:

apple,banana,cherry
Output#
Melon

Example 2#

Input#
Banana
Filter#

Operator: not in caseless list

Path:

Filter:

apple,banana,cherry
Output#
null

Example 3#

Input#
[
"Apple",
"Melon",
"Banana",
{
"Fruit": "Orange"
}
]
Filter#

Operator: not in caseless list

Path:

Filter:

apple,banana,cherry
Output#
[
"Melon",
{
"Fruit": "Orange"
}
]

Operator: contains#

Returns an entire value if any of the elements matches a string given in a filter, `null` otherwise.

Filter Format: string

Example 1#

Input#
apple
Filter#

Operator: contains

Path:

Filter:

apple
Output#
apple

Example 2#

Input#
banana
Filter#

Operator: contains

Path:

Filter:

apple
Output#
null

Example 3#

Input#
[
"apple",
"banana",
"cherry"
]
Filter#

Operator: contains

Path:

Filter:

apple
Output#
[
"apple",
"banana",
"cherry"
]

Operator: contains caseless#

Returns an entire value if any of the elements matches a string given in a filter, `null` otherwise. The matching is peformed case-insensitively.

Filter Format: string

Example 1#

Input#
Apple
Filter#

Operator: contains caseless

Path:

Filter:

apple
Output#
Apple

Example 2#

Input#
[
"Apple",
"Banana",
"Cherry"
]
Filter#

Operator: contains caseless

Path:

Filter:

apple
Output#
[
"Apple",
"Banana",
"Cherry"
]

Operator: doesn't contain#

Returns an entire value if all of the elements doesn't match a string given in a filter, `null` otherwise.

Filter Format: string

Example 1#

Input#
apple
Filter#

Operator: doesn't contain

Path:

Filter:

apple
Output#
null

Example 2#

Input#
banana
Filter#

Operator: doesn't contain

Path:

Filter:

apple
Output#
banana

Example 3#

Input#
[
"apple",
"banana",
"cherry"
]
Filter#

Operator: doesn't contain

Path:

Filter:

apple
Output#
null

Operator: doesn't contain caseless#

Returns an entire value if all of the elements doesn't match a string given in a filter, `null` otherwise. The matching is peformed case-insensitively.

Filter Format: string

Example 1#

Input#
Apple
Filter#

Operator: doesn't contain caseless

Path:

Filter:

apple
Output#
null

Example 2#

Input#
banana
Filter#

Operator: doesn't contain caseless

Path:

Filter:

apple
Output#
banana

Example 3#

Input#
[
"Apple",
"Banana",
"Cherry"
]
Filter#

Operator: doesn't contain caseless

Path:

Filter:

apple
Output#
null

Operator: wildcard: contains#

Returns an entire value if any of the elements matches a wildcard pattern given in a filter, `null` otherwise.

Filter Format: string

Example 1#

Input#
apple
Filter#

Operator: wildcard: contains

Path:

Filter:

*a*
Output#
apple

Example 2#

Input#
[
"apple",
"banana",
"cherry"
]
Filter#

Operator: wildcard: contains

Path:

Filter:

*a*
Output#
[
"apple",
"banana",
"cherry"
]

Operator: wildcard: contains caseless#

Returns an entire value if any of the elements matches a wildcard pattern given in a filter, `null` otherwise. The matching is peformed case-insensitively.

Filter Format: string

Example 1#

Input#
Apple
Filter#

Operator: wildcard: contains caseless

Path:

Filter:

*a*
Output#
Apple

Example 2#

Input#
[
"Apple",
"Banana",
"Cherry"
]
Filter#

Operator: wildcard: contains caseless

Path:

Filter:

*a*
Output#
[
"Apple",
"Banana",
"Cherry"
]

Operator: wildcard: doesn't contain#

Returns an entire value if all of the elements doesn't match a wildcard pattern given in a filter, `null` otherwise.

Filter Format: string

Example 1#

Input#
apple
Filter#

Operator: wildcard: doesn't contain

Path:

Filter:

*a*
Output#
null

Example 2#

Input#
cherry
Filter#

Operator: wildcard: doesn't contain

Path:

Filter:

*a*
Output#
cherry

Example 3#

Input#
[
"cherry",
"melon"
]
Filter#

Operator: wildcard: doesn't contain

Path:

Filter:

*a*
Output#
[
"cherry",
"melon"
]

Operator: wildcard: doesn't contain caseless#

Returns an entire value if all of the elements doesn't match a wildcard pattern given in a filter, `null` otherwise. The matching is peformed case-insensitively.

Filter Format: string

Example 1#

Input#
Apple
Filter#

Operator: wildcard: doesn't contain caseless

Path:

Filter:

*a*
Output#
null

Example 2#

Input#
cherry
Filter#

Operator: wildcard: doesn't contain caseless

Path:

Filter:

*a*
Output#
cherry

Example 3#

Input#
[
"Cherry",
"Melon"
]
Filter#

Operator: wildcard: doesn't contain caseless

Path:

Filter:

*a*
Output#
[
"Cherry",
"Melon"
]

Operator: regex: contains#

Returns an entire value if any of the elements matches a regular expression given in a filter, `null` otherwise.

Filter Format: string

Example 1#

Input#
apple
Filter#

Operator: regex: contains

Path:

Filter:

.*a.*
Output#
apple

Example 2#

Input#
[
"apple",
"banana",
"cherry"
]
Filter#

Operator: regex: contains

Path:

Filter:

.*a.*
Output#
[
"apple",
"banana",
"cherry"
]

Operator: regex: contains caseless#

Returns an entire value if any of the elements matches a regular expression given in a filter, `null` otherwise. The matching is peformed case-insensitively.

Filter Format: string

Example 1#

Input#
Apple
Filter#

Operator: regex: contains caseless

Path:

Filter:

.*a.*
Output#
Apple

Example 2#

Input#
[
"Apple",
"Banana",
"Cherry"
]
Filter#

Operator: regex: contains caseless

Path:

Filter:

.*a.*
Output#
[
"Apple",
"Banana",
"Cherry"
]

Operator: regex: doesn't contain#

Returns an entire value if all of the elements doesn't match a regular expression given in a filter, `null` otherwise.

Filter Format: string

Example 1#

Input#
apple
Filter#

Operator: regex: doesn't contain

Path:

Filter:

.*a.*
Output#
null

Example 2#

Input#
cherry
Filter#

Operator: regex: doesn't contain

Path:

Filter:

.*a.*
Output#
cherry

Example 3#

Input#
[
"cherry",
"melon"
]
Filter#

Operator: regex: doesn't contain

Path:

Filter:

.*a.*
Output#
[
"cherry",
"melon"
]

Operator: regex: doesn't contain caseless#

Returns an entire value if all of the elements doesn't match a regular expression given in a filter, `null` otherwise. The matching is peformed case-insensitively.

Filter Format: string

Example 1#

Input#
Apple
Filter#

Operator: regex: doesn't contain caseless

Path:

Filter:

.*a.*
Output#
null

Example 2#

Input#
cherry
Filter#

Operator: regex: doesn't contain caseless

Path:

Filter:

.*a.*
Output#
cherry

Example 3#

Input#
[
"Cherry",
"Melon"
]
Filter#

Operator: regex: doesn't contain caseless

Path:

Filter:

.*a.*
Output#
[
"Cherry",
"Melon"
]

Operator: matches any line of#

Returns a set of elements which matches any line of a text given in a filter.

Filter Format: string

Example 1#

Input#
banana
Filter#

Operator: matches any line of

Path:

Filter:

apple
banana
cherry
Output#
banana

Example 2#

Input#
[
"apple",
"banana",
"cherry"
]
Filter#

Operator: matches any line of

Path:

Filter:

orange
banana
apple
Output#
[
"apple",
"banana"
]

Example 3#

Input#
[
"apple",
"banana",
"cherry"
]
Filter#

Operator: matches any line of

Path:

Filter:

melon
lemon
orange
Output#
[
]

Operator: matches any caseless line of#

Returns a set of elements which matches any line of a text given in a filter. The matching is peformed case-insensitively.

Filter Format: string

Example 1#

Input#
Banana
Filter#

Operator: matches any caseless line of

Path:

Filter:

apple
banana
cherry
Output#
Banana

Example 2#

Input#
[
"Apple",
"Banana",
"Cherry"
]
Filter#

Operator: matches any caseless line of

Path:

Filter:

orange
banana
apple
Output#
[
"Apple",
"Banana"
]

Operator: doesn't match any line of#

Returns a set of elements which doesn't match any line of a text given in a filter.

Filter Format: string

Example 1#

Input#
banana
Filter#

Operator: doesn't match any line of

Path:

Filter:

apple
banana
cherry
Output#
null

Example 2#

Input#
[
"apple",
"banana",
"cherry"
]
Filter#

Operator: doesn't match any line of

Path:

Filter:

melon
orange
banana
Output#
[
"apple",
"cherry"
]

Operator: doesn't match any caseless line of#

Returns a set of elements which doesn't match any line of a text given in a filter. The matching is peformed case-insensitively.

Filter Format: string

Example 1#

Input#
Banana
Filter#

Operator: doesn't match any caseless line of

Path:

Filter:

apple
banana
cherry
Output#
null

Example 2#

Input#
[
"Apple",
"Banana",
"Cherry"
]
Filter#

Operator: doesn't match any caseless line of

Path:

Filter:

melon
lemon
orange
Output#
[
"Apple",
"Banana",
"Cherry"
]

Example 3#

Input#
[
"Apple",
"Banana",
"Cherry"
]
Filter#

Operator: doesn't match any caseless line of

Path:

Filter:

melon
orange
banana
Output#
[
"Apple",
"Cherry"
]

Operator: matches any string of#

Returns a set of elements which matches any strings given in a filter.

Filter Format: <JSON string> or <JSON array of string>

Example 1#

Input#
banana
Filter#

Operator: matches any string of

Path:

Filter:

"banana"
Output#
banana

Example 2#

Input#
banana
Filter#

Operator: matches any string of

Path:

Filter:

[
"apple",
"banana",
"cherry"
]
Output#
banana

Example 3#

Input#
[
"apple",
"banana",
"cherry"
]
Filter#

Operator: matches any string of

Path:

Filter:

[
"orange",
"banana",
"apple"
]
Output#
[
"apple",
"banana"
]

Example 4#

Input#
[
"apple",
"banana",
"cherry"
]
Filter#

Operator: matches any string of

Path:

Filter:

[
"melon",
"lemon",
"orange"
]
Output#
[
]

Operator: matches any caseless string of#

Returns a set of elements which matches any strings given in a filter. The matching is peformed case-insensitively.

Filter Format: <JSON string> or <JSON array of string>

Example 1#

Input#
Banana
Filter#

Operator: matches any caseless string of

Path:

Filter:

[
"apple",
"banana",
"cherry"
]
Output#
Banana

Example 2#

Input#
[
"Apple",
"Banana",
"Cherry"
]
Filter#

Operator: matches any caseless string of

Path:

Filter:

[
"orange",
"banana",
"apple"
]
Output#
[
"Apple",
"Banana"
]

Operator: doesn't match any string of#

Returns a set of elements which doesn't match any strings given in a filter.

Filter Format: <JSON string> or <JSON array of string>

Example 1#

Input#
banana
Filter#

Operator: doesn't match any string of

Path:

Filter:

[
"apple",
"banana",
"cherry"
]
Output#
null

Example 2#

Input#
[
"apple",
"banana",
"cherry"
]
Filter#

Operator: doesn't match any string of

Path:

Filter:

[
"melon",
"orange",
"banana"
]
Output#
[
"apple",
"cherry"
]

Operator: doesn't match any caseless string of#

Returns a set of elements which doesn't match any strings given in a filter. The matching is peformed case-insensitively.

Filter Format: <JSON string> or <JSON array of string>

Example 1#

Input#
Banana
Filter#

Operator: doesn't match any caseless string of

Path:

Filter:

[
"apple",
"banana",
"cherry"
]
Output#
null

Example 2#

Input#
[
"Apple",
"Banana",
"Cherry"
]
Filter#

Operator: doesn't match any caseless string of

Path:

Filter:

[
"melon",
"orange",
"banana"
]
Output#
[
"Apple",
"Cherry"
]

Operator: wildcard: matches any string of#

Returns a set of elements which matches any wildcard patterns given in a filter.

Filter Format: <JSON string> or <JSON array of string>

Example 1#

Input#
banana
Filter#

Operator: wildcard: matches any string of

Path:

Filter:

"b?????"
Output#
banana

Example 2#

Input#
banana
Filter#

Operator: wildcard: matches any string of

Path:

Filter:

[
"b?????",
"*c*",
"*d*"
]
Output#
banana

Example 3#

Input#
[
"apple",
"banana",
"cherry"
]
Filter#

Operator: wildcard: matches any string of

Path:

Filter:

[
"b?????",
"*c*",
"*d*"
]
Output#
[
"banana",
"cherry"
]

Example 4#

Input#
[
"melon",
"lemon",
"orange"
]
Filter#

Operator: wildcard: matches any string of

Path:

Filter:

[
"b?????",
"*c*",
"*d*"
]
Output#
[
]

Operator: wildcard: matches any caseless string of#

Returns a set of elements which matches any wildcard patterns given in a filter. The matching is peformed case-insensitively.

Filter Format: <JSON string> or <JSON array of string>

Example 1#

Input#
Banana
Filter#

Operator: wildcard: matches any caseless string of

Path:

Filter:

[
"b?????",
"*c*",
"*d*"
]
Output#
Banana

Example 2#

Input#
[
"Apple",
"Banana",
"Cherry"
]
Filter#

Operator: wildcard: matches any caseless string of

Path:

Filter:

[
"b?????",
"*c*",
"*d*"
]
Output#
[
"Banana",
"Cherry"
]

Operator: wildcard: doesn't match any string of#

Returns a set of elements which doesn't match any wildcard patterns given in a filter.

Filter Format: <JSON string> or <JSON array of string>

Example 1#

Input#
banana
Filter#

Operator: wildcard: doesn't match any string of

Path:

Filter:

[
"b?????",
"*c*",
"*d*"
]
Output#
null

Example 2#

Input#
[
"apple",
"banana",
"cherry"
]
Filter#

Operator: wildcard: doesn't match any string of

Path:

Filter:

[
"b?????",
"*c*",
"*d*"
]
Output#
[
"apple"
]

Operator: wildcard: doesn't match any caseless string of#

Returns a set of elements which doesn't match any wildcard patterns given in a filter. The matching is peformed case-insensitively.

Filter Format: <JSON string> or <JSON array of string>

Example 1#

Input#
Banana
Filter#

Operator: wildcard: doesn't match any caseless string of

Path:

Filter:

[
"b?????",
"*c*",
"*d*"
]
Output#
null

Example 2#

Input#
[
"Apple",
"Banana",
"Cherry"
]
Filter#

Operator: wildcard: doesn't match any caseless string of

Path:

Filter:

[
"b?????",
"*c*",
"*d*"
]
Output#
[
"Apple"
]

Operator: regex: matches any string of#

Returns a set of elements which matches any regular expression patterns given in a filter.

Filter Format: <JSON string> or <JSON array of string>

Example 1#

Input#
banana
Filter#

Operator: regex: matches any string of

Path:

Filter:

"b....."
Output#
banana

Example 2#

Input#
banana
Filter#

Operator: regex: matches any string of

Path:

Filter:

[
"b.....",
".*c.*",
".*d.*"
]
Output#
banana

Example 3#

Input#
[
"apple",
"banana",
"cherry"
]
Filter#

Operator: regex: matches any string of

Path:

Filter:

[
"b.....",
".*c.*",
".*d.*"
]
Output#
[
"banana",
"cherry"
]

Example 4#

Input#
[
"melon",
"lemon",
"orange"
]
Filter#

Operator: regex: matches any string of

Path:

Filter:

[
"b.....",
".*c.*",
".*d.*"
]
Output#
[
]

Operator: regex: matches any caseless string of#

Returns a set of elements which matches any regular expression patterns given in a filter. The matching is peformed case-insensitively.

Filter Format: <JSON string> or <JSON array of string>

Example 1#

Input#
Banana
Filter#

Operator: regex: matches any caseless string of

Path:

Filter:

[
"b.....",
".*c.*",
".*d.*"
]
Output#
Banana

Example 2#

Input#
[
"Apple",
"Banana",
"Cherry"
]
Filter#

Operator: regex: matches any caseless string of

Path:

Filter:

[
"b.....",
".*c.*",
".*d.*"
]
Output#
[
"Banana",
"Cherry"
]

Operator: regex: doesn't match any string of#

Returns a set of elements which doesn't match any regular expression patterns given in a filter.

Filter Format: <JSON string> or <JSON array of string>

Example 1#

Input#
banana
Filter#

Operator: regex: doesn't match any string of

Path:

Filter:

[
"b.....",
".*c.*",
".*d.*"
]
Output#
null

Example 2#

Input#
[
"apple",
"banana",
"cherry"
]
Filter#

Operator: regex: doesn't match any string of

Path:

Filter:

[
"b.....",
".*c.*",
".*d.*"
]
Output#
[
"apple"
]

Operator: regex: doesn't match any caseless string of#

Returns a set of elements which doesn't match any regular expression patterns given in a filter. The matching is peformed case-insensitively.

Filter Format: <JSON string> or <JSON array of string>

Example 1#

Input#
Banana
Filter#

Operator: regex: doesn't match any caseless string of

Path:

Filter:

[
"b.....",
".*c.*",
".*d.*"
]
Output#
null

Example 2#

Input#
[
"Apple",
"Banana",
"Cherry"
]
Filter#

Operator: regex: doesn't match any caseless string of

Path:

Filter:

[
"b.....",
".*c.*",
".*d.*"
]
Output#
[
"Apple"
]

Operator: contains any line of#

Returns an entire value if any of the elements matches any line of a text given in a filter, `null` otherwise.

Filter Format: string

Example 1#

Input#
banana
Filter#

Operator: contains any line of

Path:

Filter:

apple
banana
cherry
Output#
banana

Example 2#

Input#
[
"apple",
"banana",
"cherry"
]
Filter#

Operator: contains any line of

Path:

Filter:

melon
orange
banana
Output#
[
"apple",
"banana",
"cherry"
]

Example 3#

Input#
[
"apple",
"banana",
"cherry"
]
Filter#

Operator: contains any line of

Path:

Filter:

melon
lemon
orange
Output#
null

Operator: contains any caseless line of#

Returns an entire value if any of the elements matches any line of a text given in a filter, `null` otherwise. The matching is peformed case-insensitively.

Filter Format: string

Example 1#

Input#
Banana
Filter#

Operator: contains any caseless line of

Path:

Filter:

apple
banana
cherry
Output#
Banana

Example 2#

Input#
[
"Apple",
"Banana",
"Cherry"
]
Filter#

Operator: contains any caseless line of

Path:

Filter:

melon
orange
banana
Output#
[
"Apple",
"Banana",
"Cherry"
]

Operator: doesn't contain any line of#

Returns an entire value if all of the elements doesn't match any line of a text given in a filter, `null` otherwise.

Filter Format: string

Example 1#

Input#
banana
Filter#

Operator: doesn't contain any line of

Path:

Filter:

apple
banana
cherry
Output#
null

Example 2#

Input#
[
"apple",
"banana",
"cherry"
]
Filter#

Operator: doesn't contain any line of

Path:

Filter:

melon
lemon
orange
Output#
[
"apple",
"banana",
"cherry"
]

Example 3#

Input#
[
"apple",
"banana",
"cherry"
]
Filter#

Operator: doesn't contain any line of

Path:

Filter:

melon
orange
banana
Output#
null

Operator: doesn't contain any caseless line of#

Returns an entire value if all of the elements doesn't match any line of a text given in a filter, `null` otherwise. The matching is peformed case-insensitively.

Filter Format: string

Example 1#

Input#
Banana
Filter#

Operator: doesn't contain any caseless line of

Path:

Filter:

apple
banana
cherry
Output#
null

Example 2#

Input#
[
"Apple",
"Banana",
"Cherry"
]
Filter#

Operator: doesn't contain any caseless line of

Path:

Filter:

melon
lemon
orange
Output#
[
"Apple",
"Banana",
"Cherry"
]

Example 3#

Input#
[
"Apple",
"Banana",
"Cherry"
]
Filter#

Operator: doesn't contain any caseless line of

Path:

Filter:

melon
orange
banana
Output#
null

Operator: contains any string of#

Returns an entire value if any of the elements matches any strings given in a filter, `null` otherwise.

Filter Format: <JSON string> or <JSON array of string>

Example 1#

Input#
banana
Filter#

Operator: contains any string of

Path:

Filter:

"banana"
Output#
banana

Example 2#

Input#
banana
Filter#

Operator: contains any string of

Path:

Filter:

[
"apple",
"banana",
"cherry"
]
Output#
banana

Example 3#

Input#
[
"apple",
"banana",
"cherry"
]
Filter#

Operator: contains any string of

Path:

Filter:

[
"melon",
"orange",
"banana"
]
Output#
[
"apple",
"banana",
"cherry"
]

Example 4#

Input#
[
"apple",
"banana",
"cherry"
]
Filter#

Operator: contains any string of

Path:

Filter:

[
"melon",
"lemon",
"orange"
]
Output#
null

Operator: contains any caseless line of#

Returns an entire value if any of the elements matches any strings given in a filter, `null` otherwise. The matching is peformed case-insensitively.

Filter Format: <JSON string> or <JSON array of string>

Example 1#

Input#
Banana
Filter#

Operator: contains any caseless line of

Path:

Filter:

[
"apple",
"banana",
"cherry"
]
Output#
Banana

Example 2#

Input#
[
"Apple",
"Banana",
"Cherry"
]
Filter#

Operator: contains any caseless line of

Path:

Filter:

[
"melon",
"orange",
"banana"
]
Output#
[
"Apple",
"Banana",
"Cherry"
]

Operator: doesn't contain any string of#

Returns an entire value if all of the elements doesn't match any strings given in a filter, `null` otherwise.

Filter Format: <JSON string> or <JSON array of string>

Example 1#

Input#
banana
Filter#

Operator: doesn't contain any string of

Path:

Filter:

[
"apple",
"banana",
"cherry"
]
Output#
null

Example 2#

Input#
[
"apple",
"banana",
"cherry"
]
Filter#

Operator: doesn't contain any string of

Path:

Filter:

[
"melon",
"lemon",
"orange"
]
Output#
[
"apple",
"banana",
"cherry"
]

Example 3#

Input#
[
"apple",
"banana",
"cherry"
]
Filter#

Operator: doesn't contain any string of

Path:

Filter:

[
"melon",
"orange",
"banana"
]
Output#
null

Operator: doesn't contain any caseless line of#

Returns an entire value if all of the elements doesn't match any strings given in a filter, `null` otherwise. The matching is peformed case-insensitively.

Filter Format: <JSON string> or <JSON array of string>

Example 1#

Input#
Banana
Filter#

Operator: doesn't contain any caseless line of

Path:

Filter:

[
"apple",
"banana",
"cherry"
]
Output#
null

Example 2#

Input#
[
"Apple",
"Banana",
"Cherry"
]
Filter#

Operator: doesn't contain any caseless line of

Path:

Filter:

[
"melon",
"lemon",
"orange"
]
Output#
[
"Apple",
"Banana",
"Cherry"
]

Example 3#

Input#
[
"Apple",
"Banana",
"Cherry"
]
Filter#

Operator: doesn't contain any caseless line of

Path:

Filter:

[
"melon",
"orange",
"banana"
]
Output#
null

Operator: wildcard: contains any string of#

Returns an entire value if any of the elements matches any wildcard patterns given in a filter, `null` otherwise.

Filter Format: <JSON string> or <JSON array of string>

Example 1#

Input#
banana
Filter#

Operator: wildcard: contains any string of

Path:

Filter:

"b?????"
Output#
banana

Example 2#

Input#
banana
Filter#

Operator: wildcard: contains any string of

Path:

Filter:

[
"b?????",
"*c*",
"*d*"
]
Output#
banana

Example 3#

Input#
[
"apple",
"banana",
"cherry"
]
Filter#

Operator: wildcard: contains any string of

Path:

Filter:

[
"b?????",
"*c*",
"*d*"
]
Output#
[
"apple",
"banana",
"cherry"
]

Example 4#

Input#
[
"melon",
"lemon",
"orange"
]
Filter#

Operator: wildcard: contains any string of

Path:

Filter:

[
"b?????",
"*c*",
"*d*"
]
Output#
null

Operator: wildcard: contains any caseless string of#

Returns an entire value if any of the elements matches any wildcard patterns given in a filter, `null` otherwise. The matching is peformed case-insensitively.

Filter Format: <JSON string> or <JSON array of string>

Example 1#

Input#
Banana
Filter#

Operator: wildcard: contains any caseless string of

Path:

Filter:

[
"b?????",
"*c*",
"*d*"
]
Output#
Banana

Example 2#

Input#
[
"Apple",
"Banana",
"Cherry"
]
Filter#

Operator: wildcard: contains any caseless string of

Path:

Filter:

[
"b?????",
"*c*",
"*d*"
]
Output#
[
"Apple",
"Banana",
"Cherry"
]

Operator: wildcard: doesn't contain any string of#

Returns an entire value if all of the elements doesn't match any wildcard patterns given in a filter, `null` otherwise.

Filter Format: <JSON string> or <JSON array of string>

Example 1#

Input#
banana
Filter#

Operator: wildcard: doesn't contain any string of

Path:

Filter:

[
"b?????",
"*c*",
"*d*"
]
Output#
null

Example 2#

Input#
[
"apple",
"banana",
"cherry"
]
Filter#

Operator: wildcard: doesn't contain any string of

Path:

Filter:

[
"b?????",
"*c*",
"*d*"
]
Output#
null

Example 3#

Input#
[
"melon",
"lemon",
"orange"
]
Filter#

Operator: wildcard: doesn't contain any string of

Path:

Filter:

[
"b?????",
"*c*",
"*d*"
]
Output#
[
"melon",
"lemon",
"orange"
]

Operator: wildcard: doesn't contain any caseless line of#

Returns an entire value if all of the elements doesn't match any wildcard patterns given in a filter, `null` otherwise. The matching is peformed case-insensitively.

Filter Format: <JSON string> or <JSON array of string>

Example 1#

Input#
Banana
Filter#

Operator: wildcard: doesn't contain any caseless line of

Path:

Filter:

[
"b?????",
"*c*",
"*d*"
]
Output#
null

Example 2#

Input#
[
"Melon",
"Lemon",
"Orange"
]
Filter#

Operator: wildcard: doesn't contain any caseless line of

Path:

Filter:

[
"b?????",
"*c*",
"*d*"
]
Output#
[
"Melon",
"Lemon",
"Orange"
]

Example 3#

Input#
[
"Apple",
"Banana",
"Cherry"
]
Filter#

Operator: wildcard: doesn't contain any caseless line of

Path:

Filter:

[
"b?????",
"*c*",
"*d*"
]
Output#
null

Operator: regex: contains any string of#

Returns an entire value if any of the elements matches any regular expression patterns given in a filter, `null` otherwise.

Filter Format: <JSON string> or <JSON array of string>

Example 1#

Input#
banana
Filter#

Operator: regex: contains any string of

Path:

Filter:

"b....."
Output#
banana

Example 2#

Input#
banana
Filter#

Operator: regex: contains any string of

Path:

Filter:

[
"b.....",
".*c.*",
".*d.*"
]
Output#
banana

Example 3#

Input#
[
"apple",
"banana",
"cherry"
]
Filter#

Operator: regex: contains any string of

Path:

Filter:

[
"b.....",
".*c.*",
".*d.*"
]
Output#
[
"apple",
"banana",
"cherry"
]

Example 4#

Input#
[
"melon",
"lemon",
"orange"
]
Filter#

Operator: regex: contains any string of

Path:

Filter:

[
"b.....",
".*c.*",
".*d.*"
]
Output#
null

Operator: regex: contains any caseless string of#

Returns an entire value if any of the elements matches any regex patterns given in a filter, `null` otherwise. The matching is peformed case-insensitively.

Filter Format: <JSON string> or <JSON array of string>

Example 1#

Input#
Banana
Filter#

Operator: regex: contains any caseless string of

Path:

Filter:

[
"b.....",
".*c.*",
".*d.*"
]
Output#
Banana

Example 2#

Input#
[
"Apple",
"Banana",
"Cherry"
]
Filter#

Operator: regex: contains any caseless string of

Path:

Filter:

[
"b.....",
".*c.*",
".*d.*"
]
Output#
[
"Apple",
"Banana",
"Cherry"
]

Operator: regex: doesn't contain any string of#

Returns an entire value if all of the elements doesn't match any regex patterns given in a filter, `null` otherwise.

Filter Format: <JSON string> or <JSON array of string>

Example 1#

Input#
banana
Filter#

Operator: regex: doesn't contain any string of

Path:

Filter:

[
"b.....",
".*c.*",
".*d.*"
]
Output#
null

Example 2#

Input#
[
"apple",
"banana",
"cherry"
]
Filter#

Operator: regex: doesn't contain any string of

Path:

Filter:

[
"b.....",
".*c.*",
".*d.*"
]
Output#
null

Example 3#

Input#
[
"melon",
"lemon",
"orange"
]
Filter#

Operator: regex: doesn't contain any string of

Path:

Filter:

[
"b.....",
".*c.*",
".*d.*"
]
Output#
[
"melon",
"lemon",
"orange"
]

Operator: regex: doesn't contain any caseless line of#

Returns an entire value if all of the elements doesn't match any regex patterns given in a filter, `null` otherwise. The matching is peformed case-insensitively.

Filter Format: <JSON string> or <JSON array of string>

Example 1#

Input#
Banana
Filter#

Operator: regex: doesn't contain any caseless line of

Path:

Filter:

[
"b.....",
".*c.*",
".*d.*"
]
Output#
null

Example 2#

Input#
[
"Melon",
"Lemon",
"Orange"
]
Filter#

Operator: regex: doesn't contain any caseless line of

Path:

Filter:

[
"b.....",
".*c.*",
".*d.*"
]
Output#
[
"Melon",
"Lemon",
"Orange"
]

Example 3#

Input#
[
"Apple",
"Banana",
"Cherry"
]
Filter#

Operator: regex: doesn't contain any caseless line of

Path:

Filter:

[
"b.....",
".*c.*",
".*d.*"
]
Output#
null

Operator: matches expressions of#

Returns the result of a value filtered by `expressions` given. See `Filter Syntax` for the details of `expressions`.

Filter Format: expressions

Example 1#

Input#
[
"aaa.dat",
"bbb.exe",
"ccc.exe"
]
Filter#

Operator: matches expressions of

Path:

Filter:

{
"ends with": ".exe",
"starts with": "c"
}
Output#
[
"ccc.exe"
]

Example 2#

Input#
{
"Domain": [
"www.paloaltonetworks.com",
"www.paloaltonetworks.co.jp",
"www.demisto.com"
],
"IP": [
"1.1.1.1",
"2.2.2.2",
"3.3.3.3"
]
}
Filter#

Operator: matches expressions of

Path: Domain

Filter:

[
{"ends with": ".co.jp"},
"or",
{"includes": "demisto"}
]
Output#
{
"Domain": [
"www.paloaltonetworks.co.jp",
"www.demisto.com"
],
"IP": [
"1.1.1.1",
"2.2.2.2",
"3.3.3.3"
]
}

Operator: matches conditions of#

Returns the result of a value filtered by `conditions` given. See `Filter Syntax` for the details of `conditions`.

Filter Format: conditions

Example 1#

Input#
{
"TrustedDevices": [
"D000002",
"D000003"
],
"Events": [
{
"Description": "User Logged In - Success",
"DeviceID": "D000001"
},
{
"Description": "File uploaded",
"DeviceID": "D000001"
},
{
"Description": "File downloaded",
"DeviceID": "D000002"
},
{
"Description": "User Logged In - Failed",
"DeviceID": "D000003"
}
]
}
Filter#

Operator: matches conditions of

Path: Events

Filter:

[
{
"Description": {
"==": "User Logged In - Failed"
}
},
"or",
[
{
"Description": {
"in list": "File uploaded,File downloaded"
}
},
"and",
"not",
{
"DeviceID": {
"matches any string of": "${local.TrustedDevices}"
}
}
]
]
Output#
{
"Events": [
{
"Description": "File uploaded",
"DeviceID": "D000001"
},
{
"Description": "User Logged In - Failed",
"DeviceID": "D000003"
}
],
"TrustedDevices": [
"D000002",
"D000003"
]
}

Example 2#

Input#
{
"Result": {
"File": [
{
"Name": "a.dat",
"Size": 100
},
{
"Name": "b.exe",
"Size": 200
},
{
"Name": "c.txt",
"Size": 300
}
],
"Host": [
{
"Name": "computer1",
"IP": "1.1.1.1"
},
{
"Name": "server1",
"IP": "2.2.2.2"
}
]
}
}
Filter#

Operator: matches conditions of

Path:

Filter:

{
"Result.File": {
"is filtered with" : {
"Name": {
"ends with": ".exe"
}
}
},
"Result.Host": {
"is filtered with" : {
"Name": {
"starts with": "server"
}
}
}
}
Output#
{
"Result": {
"File": [
{
"Name": "b.exe",
"Size": 200
}
],
"Host": [
{
"Name": "server1",
"IP": "2.2.2.2"
}
]
}
}

Example 3#

Input#
{
"Result": {
"File": [
{
"Name": "a.dat",
"Size": 100
},
{
"Name": "b.exe",
"Size": 200
},
{
"Name": "c.txt",
"Size": 300
}
],
"Host": [
{
"Name": "computer1",
"IP": "1.1.1.1"
},
{
"Name": "server1",
"IP": "2.2.2.2"
}
]
}
}
Filter#

Operator: matches conditions of

Path:

Filter:

{
"Result": {
"is filtered with" : {
"File": {
"is filtered with": {
"Name": {
"ends with": ".exe"
}
}
},
"Host": {
"is filtered with": {
"Name": {
"starts with": "server"
}
}
}
}
}
}
Output#
{
"Result": {
"File": [
{
"Name": "b.exe",
"Size": 200
}
],
"Host": [
{
"Name": "server1",
"IP": "2.2.2.2"
}
]
}
}

Example 4#

Input#
{
"Result" : {
"Domain" : [
"www.paloaltonetworks.com",
"www.demisto.com",
"paloaltonetowrks.com"
],
"IP" : [
"1.1.1.1",
"2.2.2.2",
"3.3.3.3"
]
}
}
Filter#

Operator: matches conditions of

Path:

Filter:

{
"Result.Domain": {
"is filtered with": {
"": {
"starts with": "www."
}
}
}
}
Output#
{
"Result" : {
"Domain" : [
"www.paloaltonetworks.com",
"www.demisto.com"
],
"IP" : [
"1.1.1.1",
"2.2.2.2",
"3.3.3.3"
]
}
}

Operator: value matches expressions of#

Evaluates each value of dictionary elements or each element for values whose data type is not `dictionary`, and returns a set of the elements matched to expressions given in a filter. See `Filter Syntax` for the details of `expressions`.

Filter Format: expressions

Example 1#

Input#
[
"1.1.1.1",
"2.2.2.2",
"3.3.3.3"
]
Filter#

Operator: value matches expressions of

Path:

Filter:

{
"contains": "1.1.1.1"
}
Output#
[
"1.1.1.1"
]

Example 2#

Input#
{
"Communication": {
"Host1": [
"1.1.1.1",
"2.2.2.2"
],
"Host2": "1.1.1.1",
"Host3": [
"3.3.3.3",
"4.4.4.4"
]
}
}
Filter#

Operator: value matches expressions of

Path: Communication

Filter:

{
"contains": "1.1.1.1"
}
Output#
{
"Communication": {
"Host1": [
"1.1.1.1",
"2.2.2.2"
],
"Host2": "1.1.1.1"
}
}

Operator: value matches conditions of#

Evaluates each value of dictionary elements, and returns a set of the elements matched to conditions given in a filter. See `Filter Syntax` for the details of `conditions`.

Filter Format: conditions

Example 1#

Input#
{
"Host1": {
"User": "JDOE",
"IP": "192.168.1.1",
"Score": 30
},
"Host2": {
"User": "TYAMADA",
"IP": "192.168.1.2",
"Score": 10
},
"Host3": {
"User": "MBLACK",
"IP": "3.3.3.3",
"Score": 40
}
}
Filter#

Operator: value matches conditions of

Path:

Filter:

{
"Score": {
">=": 20
}
}
Output#
{
"Host1": {
"User": "JDOE",
"IP": "192.168.1.1",
"Score": 30
},
"Host3": {
"User": "MBLACK",
"IP": "3.3.3.3",
"Score": 40
}
}

Example 2#

Input#
{
"Host1": {
"User": "JDOE",
"IP": "192.168.1.1",
"Score": 30,
"File": {
"Risk": [
"xxx.exe",
"yyy.pdf"
]
}
},
"Host2": {
"User": "TYAMADA",
"IP": "192.168.1.2",
"Score": 10
},
"Host3": {
"User": "MBLACK",
"IP": "3.3.3.3",
"Score": 40,
"File": {
"Risk": [
"aaa.pdf",
"bbb.exe"
]
}
}
}
Filter#

Operator: value matches conditions of

Path:

Filter:

{
"Score": {
">=": 20
},
"File.Risk": {
"is filtered with": {
"": {
"ends with": ".exe"
}
}
}
}
Output#
{
"Host1": {
"User": "JDOE",
"IP": "192.168.1.1",
"Score": 30,
"File": {
"Risk": [
"xxx.exe"
]
}
},
"Host3": {
"User": "MBLACK",
"IP": "3.3.3.3",
"Score": 40,
"File": {
"Risk": [
"bbb.exe"
]
}
}
}

Operator: json: encode array#

Returns an string in JSON which is encoded the entire value.

Filter Format: dict[str,Any]

ParameterData TypeDescription
indentintThe number of spaces per indent (Default: None)

Example 1#

Input#
[
10,
20
]
Filter#

Operator: json: encode array

Path:

Filter:

{
}
Output#
"[10,20]"

Example 2#

Input#
[
10,
20
]
Filter#

Operator: json: encode array

Path:

Filter:

{
"indent": 4
}
Output#
[
"1.1.1.1",
"2.2.2.2"
]

Operator: json: encode#

Encodes each element and returns a set of JSON-encoded string.

Filter Format: dict[str,Any]

ParameterData TypeDescription
indentintThe number of spaces per indent (Default: None)

Example 1#

Input#
[
{
"xxx": 10
},
20
]
Filter#

Operator: json: encode

Path:

Filter:

{
}
Output#
[
{"xxx":10},
20
]

Example 2#

Input#
[
{
"xxx": 10
},
20
]
Filter#

Operator: json: encode

Path:

Filter:

{
"indent": 4
}
Output#
[
{
"xxx": 10
},
20
]

Operator: json: decode#

Returns a set of JSON decoded-values from the each element.

Filter Format: dict[str,Any]

ParameterData TypeDescription

(parameter is currently not required)

Example 1#

Input#
[
{"xxx":10},
{"yyy":20}
]
Filter#

Operator: json: decode

Path:

Filter:

{
}
Output#
[
{
"xxx": 10
},
{
"yyy": 20
}
]

Operator: base64: encode#

Encodes each element and returns a set of BASE64-encoded string.

Filter Format: dict[str,Any]

ParameterData TypeDescription

(parameter is currently not required)

Example 1#

Input#
[
"xxx",
"yyy"
]
Filter#

Operator: base64: encode

Path:

Filter:

{
}
Output#
[
"eHh4",
"eXl5"
]

Operator: base64: decode#

Returns a set of BASE64 decoded-values from the each element.

Filter Format: dict[str,Any]

ParameterData TypeDescription

(parameter is currently not required)

Example 1#

Input#
[
"eHh4",
"eXl5"
]
Filter#

Operator: base64: decode

Path:

Filter:

{
}
Output#
[
"xxx",
"yyy"
]

Operator: digest#

Create a set of secure hash value for each element.

Filter Format: dict[str,Any]

ParameterData TypeDescription
algorithmstringSecure hash algorithm (Default: sha256). See python hashlib for algorithm names.

Example 1#

Input#
[
"xxx",
"yyy"
]
Filter#

Operator: digest

Path:

Filter:

{
}
Output#
[
"cd2eb0837c9b4c962c22d2ff8b5441b7b45805887f051d39bf133b583baf6860",
"f2afd1cacb5441a5e65a7a460a5f9898b7b98b08aa6323a2e53c8b9a9686cd86"
]

Example 2#

Input#
[
"xxx",
"yyy"
]
Filter#

Operator: digest

Path:

Filter:

{
"algorithm": "sha256"
}
Output#
[
"cd2eb0837c9b4c962c22d2ff8b5441b7b45805887f051d39bf133b583baf6860",
"f2afd1cacb5441a5e65a7a460a5f9898b7b98b08aa6323a2e53c8b9a9686cd86"
]

Operator: is replaced with#

Replaces an entire value with a value given in a filter.

Filter Format: <JSON value>

Example 1#

Input#
[
"apple",
"banana"
]
Filter#

Operator: is replaced with

Path:

Filter:

[
{
"fruit" : "${local}"
}
]
Output#
[
{
"fruit" : [
"apple",
"banana"
]
}
]

Example 2#

Input#
{
"fruit": "apple"
}
Filter#

Operator: is replaced with

Path:

Filter:

{
"fruit": "banana",
"vegitable": "tomato"
}
Output#
{
"fruit": "banana",
"vegitable": "tomato"
}

Operator: is updated with#

If both of the data types are `dicrionary`, all the elements given in a filter are added to the value. All the values are replaced with the value given the existing key. Otherwise, it is simply replaced with a value given in a filter.

Filter Format: <JSON value>

Example 1#

Input#
[
"apple",
"banana"
]
Filter#

Operator: is updated with

Path:

Filter:

[
{
"fruit" : "${local}"
}
]
Output#
[
{
"fruit" : [
"apple",
"banana"
]
}
]

Example 2#

Input#
{
"fruit": "apple"
}
Filter#

Operator: is updated with

Path:

Filter:

{
"vegitable": "tomato"
}
Output#
{
"fruit": "banana",
"vegitable": "tomato"
}

Operator: appends#

Appends all the elements given in a filter to the value.

Filter Format: <JSON value>

Example 1#

Input#
[
"apple",
"banana"
]
Filter#

Operator: appends

Path:

Filter:

[
"cherry",
"lemon"
]
Output#
[
"apple",
"banana",
"cherry",
"lemon"
]

Example 2#

Input#
{
"File": [
"a.exe",
"b.pdf"
]
}
Filter#

Operator: appends

Path:

Filter:

{
"IP": [
"1.1.1.1",
"2.2.2.2"
]
}
Output#
[
{
"File": [
"a.exe",
"b.pdf"
]
},
{
"IP": [
"1.1.1.1",
"2.2.2.2"
]
}
]

Operator: if-then-else#

Evaluates each element with `if` condition, and returns a set of the results of `then` or `else` operations. If `if` condition is not given or returns any value, `then` operation is executed, otherwise `else` operation is executed.

Filter Format: dict[str,Any]

ParameterData TypeDescription
ifexpressions(Optional) if condition
thenexpressionsConditions to execute if if condition is not given or returns any value.
elseexpressions(Optional) Conditions to execute if if returns null.

Example 1#

Input#
[
{
"Name": "a.dat",
"Size": 100
},
{
"Name": "b.exe",
"Size": 200
},
{
"Name": "c.txt",
"Size": 300
}
]
Filter#

Operator: if-then-else

Path:

Filter:

{
"if": {
"is filtered with": {
"Name": {
"ends with": ".exe"
}
}
},
"then": {
"is updated with": {
"Executable": true
}
},
"else": {
"is updated with": {
"Executable": false
}
}
}
Output#
[
{
"Name": "a.dat",
"Size": 100,
"Executable": false
},
{
"Name": "b.exe",
"Size": 200,
"Executable": true
},
{
"Name": "c.txt",
"Size": 300,
"Executable": false
}
]

Example 2#

Input#
[
"a.dat",
"b.exe",
"c.txt"
]
Filter#

Operator: if-then-else

Path:

Filter:

{
"if": {
"ends with": ".exe"
},
"then": {
"is replaced with": 10
}
}
Output#
[
"a.dat",
10,
"c.txt"
]

Example 3#

Input#
[
"a.dat",
"b.exe",
"c.txt"
]
Filter#

Operator: if-then-else

Path:

Filter:

{
"then": {
"is replaced with": 10
}
}
Output#
[
10,
10,
10
]

Operator: switch-case#

Performs expressions for the label whose `expressions` matches the value. If any of `expressions` doesn't match the value, `default` operation is executed.

Filter Format: dict[str,Any]

ParameterData TypeDescription
switchdict[<label>, expressions](Optional) Patterns of conditions.
defaultexpressions(Optional) Conditions to execute if it doesn't match all the switch conditions.
<label>expressions(Optional) Conditions to execute if it matches the conditions given in the label.

Example 1#

Input#
[
{
"IP": "1.1.1.1",
"Score": 80
},
{
"IP": "2.2.2.2",
"Score": 50
},
{
"IP": "3.3.3.3",
"Score": 20
}
]
Filter#

Operator: switch-case

Path:

Filter:

{
"switch": {
"#low": {
"is filtered with": {
"Score": {
"<=": 30
}
}
},
"#high": {
"is filtered with": {
"Score": {
">=": 70
}
}
}
},
"#low": {
"is updated with": {
"Risk": "low"
}
},
"#high": {
"is updated with": {
"Risk": "high"
}
},
"default": {
"is updated with": {
"Risk": "middle"
}
}
}
Output#
[
{
"IP": "1.1.1.1",
"Score": 80,
"Risk": "high"
},
{
"IP": "2.2.2.2",
"Score": 50,
"Risk": "middle"
},
{
"IP": "3.3.3.3",
"Score": 20,
"Risk": "low"
}
]

Example 2#

Input#
[
{
"IP": "1.1.1.1",
"Score": 80
},
{
"IP": "2.2.2.2",
"Score": 50
},
{
"IP": "3.3.3.3",
"Score": 20
}
]
Filter#

Operator: switch-case

Path:

Filter:

{
"switch": {
"#low": {
"is filtered with": {
"Score": {
"<=": 30
}
}
},
"#high": {
"is filtered with": {
"Score": {
">=": 70
}
}
}
},
"#low": {
"is updated with": {
"Risk": "low"
}
},
"#high": {
"is updated with": {
"Risk": "high"
}
}
}
Output#
[
{
"IP": "1.1.1.1",
"Score": 80,
"Risk": "high"
},
{
"IP": "2.2.2.2",
"Score": 50
},
{
"IP": "3.3.3.3",
"Score": 20,
"Risk": "low"
}
]

Operator: collects values#

Returns a set of <value> of each element. A value is <value> for `dict`, otherwise element itself.

Filter Format: dict[str,Any]

ParameterData TypeDescription

(parameter is currently not required)

Example 1#

Input#
{
"JDOE": {
"IP": [
"1.1.1.1",
"1.1.1.2"
],
"Score": 30
},
"TYAMADA": {
"IP": "2.2.2.2",
"Score": 10
},
"MBLACK": {
"IP": "3.3.3.3",
"Score": 40
}
}
Filter#

Operator: collects values

Path:

Filter: {}

Output#
[
{
"IP": [
"1.1.1.1",
"1.1.1.2"
],
"Score": 30
},
{
"IP": "2.2.2.2",
"Score": 10
},
{
"IP": "3.3.3.3",
"Score": 40
}
]

Example 2#

Input#
[
"1.1.1.1",
"2.2.2.2",
"3.3.3.3"
]
Filter#

Operator: collects values

Path:

Filter: {}

Output#
[
"1.1.1.1",
"2.2.2.2",
"3.3.3.3"
]

Operator: collects keys#

Returns a set of <key> of each `dict` element.

Filter Format: dict[str,Any]

ParameterData TypeDescription

(parameter is currently not required)

Example 1#

Input#
{
"JDOE": {
"IP": [
"1.1.1.1",
"1.1.1.2"
],
"Score": 30
},
"TYAMADA": {
"IP": "2.2.2.2",
"Score": 10
},
"MBLACK": {
"IP": "3.3.3.3",
"Score": 40
}
}
Filter#

Operator: collects keys

Path:

Filter: {}

Output#
[
"JDOE",
"TYAMADA",
"MBLACK"
]

Operator: flattens with values#

Returns a set of <value> of all the elements in the tree.

Filter Format: dict[str,Any]

ParameterData TypeDescription

(parameter is currently not required)

Example 1#

Input#
{
"JDOE": {
"IP": [
"1.1.1.1",
"1.1.1.2"
],
"Score": 30
},
"TYAMADA": {
"IP": "2.2.2.2",
"Score": 10
},
"MBLACK": {
"IP": "3.3.3.3",
"Score": 40
}
}
Filter#

Operator: flattens with values

Path:

Filter: {}

Output#
[
"1.1.1.1",
"1.1.1.2",
30,
"2.2.2.2",
10,
"3.3.3.3",
40
]

Operator: flattens with keys#

Returns a set of <key> of all the `dict` elements in the tree.

Filter Format: dict[str,Any]

ParameterData TypeDescription

(parameter is currently not required)

Example 1#

Input#
{
"JDOE": {
"IP": [
"1.1.1.1",
"1.1.1.2"
],
"Score": 30
},
"TYAMADA": {
"IP": "2.2.2.2",
"Score": 10
},
"MBLACK": {
"IP": "3.3.3.3",
"Score": 40
}
}
Filter#

Operator: flattens with keys

Path:

Filter: {}

Output#
[
"JDOE",
"IP",
"Score",
"TYAMADA",
"IP",
"Score",
"MBLACK",
"IP",
"Score"
]

Operator: abort#

Raises an exception and exit with the value filtered at the operator. This operator is available for troubleshooting and debugging.

Filter Format: dict[str,Any]

ParameterData TypeDescription

(parameter is currently not required)

Example 1#

Filter#

Operator: abort

Path:

Filter:

{
}

Operator: email-header: decode#

Returns an string which is decoded with the email header encoding manner.

Filter Format: dict[str,Any]

ParameterData TypeDescription

(parameter is currently not required)

Example 1#

Input#
=?ISO-2022-JP?B?GyRCJCIkJCQmJCgkKhsoQg==?=
Filter#

Operator: email-header: decode

Path:

Filter:

{
}
Output#
ใ‚ใ„ใ†ใˆใŠ

Example 2#

Input#
ABC =?ISO-2022-JP?B?GyRCJCIkJCQmJCgkKhsoQg==?= XYZ
Filter#

Operator: email-header: decode

Path:

Filter:

{
}
Output#
ABC ใ‚ใ„ใ†ใˆใŠ XYZ

Operator: regex: replace#

Evaluates the pattern matching, and returns the data given in "matched" or "unmatched" according to the result. Returns the data given in "matched" if matched, "unmatch" otherwise.

Filter Format: dict[str,Any]

ParameterData TypeDescription
patternstrA pattern text in regex.
matchedAnyThe data to return when matched. capture groups such as \1 are supported.
unmatchedAny(Optional) The data to return when unmatched. If not specified, the value given will return.
caselessbool(Optional) true if the matching performs in case-insensitive, false means case-sensitive. The default value is false.
dotallbool(Optional) . (single dot) matches any of charactors excluding new line charactors by default. true if it matches any of the charactors including them. The default value is false. See re.DOTALL
multilinebool(Optional) true if the matching performs in multi-line mode, false otherwise. The default value is false. See re.MULTILINE

Example 1#

Input#
Re: Re: Fw: Hello!
Filter#

Operator: regex: replace

Path:

Filter:

{
"pattern": "( *(Re: *|Fw: *)*)(.*)",
"matched": "\\3"
}
Output#
Hello!

Example 2#

Input#
XYZ
Filter#

Operator: regex: replace

Path:

Filter:

{
"pattern": ".*(abc).*",
"matched": "\\1",
"unmatched": "unmatched"
}
Output#
unmatched

Example 3#

Input#
XYZ
Filter#

Operator: regex: replace

Path:

Filter:

{
"pattern": ".*(abc).*",
"matched": "\\1"
}
Output#
XYZ

Operator: is individually transformed with#

Transform each element with `transformers` given in a filter. See `Filter Syntax` for the details of `transformers`.

Filter Format: transformers

Example 1#

Input#
[
{
"Name": "a.dat",
"Size": 100
},
{
"Name": "b.exe",
"Size": 200
},
{
"Name": "c.txt",
"Size": 300
}
]
Filter#

Operator: is individually transformed with

Path:

Filter:

{
"json: encode": {},
"base64: encode": {}
}
Output#
[
"eyJOYW1lIjogImEuZGF0IiwgIlNpemUiOiAxMDB9",
"eyJOYW1lIjogImIuZXhlIiwgIlNpemUiOiAyMDB9",
"eyJOYW1lIjogImMudHh0IiwgIlNpemUiOiAzMDB9"
]

Example 2#

Input#
{
"File": [
{
"Name": "a.dat",
"Size": 100
},
{
"Name": "b.exe",
"Size": 200
}
],
"IP": [
"1.1.1.1",
"2.2.2.2"
]
}
Filter#

Operator: is individually transformed with

Path: File

Filter:

{
"is filtered with": {
"Name": {
"ends with": ".exe"
}
},
"json: encode": {},
"base64: encode": {}
}
Output#
{
"File": [
"eyJOYW1lIjogImIuZXhlIiwgIlNpemUiOiAyMDB9"
],
"IP": [
"1.1.1.1",
"2.2.2.2"
]
}

Example 3#

Input#
[
{
"Name": "a.dat",
"Size": 100
},
{
"Name": "b.exe",
"Size": 200
}
]
Filter#

Operator: is individually transformed with

Path:

Filter:

{
"is replaced with": {
"User": "JDOE"
}
}
Output#
[
{
"User": "JDOE"
},
{
"User": "JDOE"
}
]

Example 4#

Input#
[
{
"Name": "a.dat",
"Size": 100
},
{
"Name": "b.exe",
"Size": 200
}
]
Filter#

Operator: is individually transformed with

Path:

Filter:

{
"is updated with": {
"Size": "${..Size=val+1}"
}
}
Output#
[
{
"Name": "a.dat",
"Size": 101
},
{
"Name": "b.exe",
"Size": 201
}
]

Operator: is collectively transformed with#

Transform elements with `transformers` given in a filter. The elements are handled and transformed as one value at the first level if the type of it is array. See `Filter Syntax` for the details of `transformers`.

Filter Format: transformers

Example 1#

Input#
[
{
"Name": "a.dat",
"Trusted": true
},
{
"Name": "b.exe",
"Trusted": false
},
{
"Name": "c.txt",
"Trusted": true
}
]
Filter#

Operator: is collectively transformed with

Path:

Filter:

{
"switch-case": {
"switch": {
"#has_untrusted": {
"is filtered with": {
"Trusted": {
"===": false
}
}
}
},
"#has_untrusted": {
"is replaced with": [
"Untrusted"
]
},
"default": {
"is replaced with": [
"Trusted"
]
}
}
}
Output#
[
"Untrusted"
]
Edit this page
Report an Issue