>
    Strata Copilot
    Advanced Filter Criteria
    Focus
    Focus
    1. Home
    2. Next‑Gen Trust Security
    3. Next-Gen Trust Security
    4. Next-Gen Trust Security Overview
    5. Notification Rules Overview
    6. Advanced Filter Criteria
    Next‑Gen Trust Security

    Advanced Filter Criteria

    Table of Contents

    Advanced Filter Criteria

    When you are creating notifications, you can use Common Expression Language (CEL) expressions for a high level of specificity in creating the filter Next-Gen Trust Security uses for your notifications.

    Common Expression Language (CEL) introduction

    The Common Expression Language (CEL) uses a simple syntax similar to expressions in C++, Java, JavaScript, and Go. CEL expressions are usually concise, single-line statements that evaluate to a single value. If the evaluation result is true, the system triggers a notification to the specified integration. If the evaluation result is false, the system takes no action.
    Inputs to a CEL expression are called variables. Each field within the event can be a variable in the CEL expression. CEL comes with standard language functions as defined in the official specification.

    Advanced CEL expression examples

    For examples of CEL expressions for each notification event, and to view the event data fields for each event type, see Event notification types.

    © 2026 Palo Alto Networks, Inc. All rights reserved.