🌙

Subscribe to the Taegis™ XDR Documentation RSS Feed at .

Learn more about RSS readers or RSS browser extensions.

Using Common Expression Language with Taegis XDR

Secureworks® Taegis™ XDR’s automations platform is compatible with Google’s Common Expression Language (CEL). You can embed CEL logic and data manipulation within connectors and templates. We have resources that can help you get started with CEL in Taegis.

Syntax

Connectors

In a connector, the CEL expression must be wrapped in ${}. For example:

${inputs.myvar}

Templates

In a template, you can wrap the CEL expression in ${}, but it doesn’t have to be. For example, the following two statements do the same thing:

${inputs.myvar}

inputs.myvar

Note

In a template, single quoted text inside double quoted text is not evaluated in a CEL expression; it’s just left as plaintext.

For example, in:

"inputs.myvar 'preserve text' inputs.newvar"

inputs.myvar and inputs.newvar are evaluated, but 'preserve text' is not evaluated.

Playbook Inputs

You must use the ${} notation when using a CEL expression as an input to a playbook.

Trigger Filter Criteria

You must use the ${} notation when using a CEL expression in trigger filter criteria.

 

On this page: