Using Common Expression Language with Taegis XDR
Secureworks® Taegis™ XDR’s automations platform is compatible with Google’s Common Expression Language (CEL). You can embed CEL logic and data manipulation within connectors and templates.
Syntax ⫘
Connectors ⫘
In a connector, the CEL expression must be wrapped in ${}. For example:
${inputs.myvar}
Templates ⫘
In a template, you can wrap the CEL expression in ${}, but it doesn’t have to be. For example, the following two statements do the same thing:
${inputs.myvar}
inputs.myvar
Note
In a template, single quoted text inside double quoted text is not evaluated in a CEL expression; it’s just left as plaintext.
For example, in:
"inputs.myvar 'preserve text' inputs.newvar"
inputs.myvar and inputs.newvar are evaluated, but 'preserve text' is not evaluated.
Playbook Inputs ⫘
You must use the ${} notation when using a CEL expression as an input to a playbook.
Trigger Filter Criteria ⫘
You must use the ${} notation when using a CEL expression in trigger filter criteria.
Related Topics ⫘
Google Common Expression Language Definition ⫘
Google Common Expression Language Extensions ⫘
XDR Supported CEL Macros ⫘