Using Common Expression Language with Taegis XDR
Secureworks® Taegis™ XDR’s automations platform is compatible with Google’s Common Expression Language (CEL). You can embed CEL logic and data manipulation within connectors and templates. We have resources that can help you get started with CEL in Taegis.
- Getting Started with CEL — See introductory information about CEL components.
- Example Use Cases for CEL — Explore ways to use CEL in Taegis.
- Supported CEL Macros — See common examples of CEL Macros used in Taegis.
- CEL Explorer — Use a Taegis native tool to test CEL expressions.
Syntax ⫘
Connectors ⫘
In a connector, the CEL expression must be wrapped in ${}
. For example:
${inputs.myvar}
Templates ⫘
In a template, you can wrap the CEL expression in ${}
, but it doesn’t have to be. For example, the following two statements do the same thing:
${inputs.myvar}
inputs.myvar
Note
In a template, single quoted text inside double quoted text is not evaluated in a CEL expression; it’s just left as plaintext.
For example, in:
"inputs.myvar 'preserve text' inputs.newvar"
inputs.myvar
and inputs.newvar
are evaluated, but 'preserve text'
is not evaluated.
Playbook Inputs ⫘
You must use the ${}
notation when using a CEL expression as an input to a playbook.
Trigger Filter Criteria ⫘
You must use the ${}
notation when using a CEL expression in trigger filter criteria.
Related Topics ⫘
Google Common Expression Language Definition ⫘
Google Common Expression Language Extensions ⫘
XDR Supported CEL Macros ⫘