regextract

Cortex XDR XQL regextract function uses regular expressions to assemble an array of matching substrings from a string.

Synopsis

regextract (<string_value>, <pattern>)

Description

The

regextract()

function accepts a string and a regular expression, and it returns an array containing substrings that match the expression.

XQL uses RE2 for its regular expression implementation.

Examples

Extract the

Account Name

from the

action_evtlog_message

. Use the arrayindex and split functions to extract the actual account name from the array created by

regextract

dataset = xdr_data 
| fields action_evtlog_message as aem 
| filter aem != null 
| alter account_name = 
    arrayindex(
        split(
            arrayindex(
                regextract(aem, "Account Name:\t\t.*\r\n")
            ,0)
        , ":")
    ,1) |
| filter account_name != null 
| limit 10

Document:Cortex XDR™ XQL Language Reference

regextract

regextract

Synopsis

Description

Examples

Recommended For You

Document:Cortex XDR™ XQL Language Reference

regextract

regextract

Synopsis

Description

Examples

Recommended For You

Recommended Videos