Anomali Query Language Reference

Anomali Query Language (AQL) is a piped language, similar to Splunk and Kusto.

Note: For OCSF schema fields, array indexes start at array[1] and not array[0]. See OCSF Schema Overview for more information.

Note: AQL boolean arguments are case-insensitive, that is, all the following boolean arguments are valid:

Positive case: True, true, t

Negative case: False, false, f