Skip to content

Commit

Permalink
[Cloud Security-S&I] RQL Operators (#1022)
Browse files Browse the repository at this point in the history
* [Cloud Security-S&I] RQL Operators

* note update

* rephrased note
  • Loading branch information
arane26 authored Dec 12, 2024
1 parent 89b50fa commit 7ee3017
Showing 1 changed file with 5 additions and 2 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -648,13 +648,16 @@ GSON/AWS: "Nov 7, 2016 9:34:21 AM"
ISO: "2011-12-04T10:15:30+01:00"
The query time ranges that are available are `_DateTime.ageInDays` , `_DateTime.ageInMonths` , `_DateTime.ageInYears` , and `_DateTime.daysBetween` . The `_DateTime.daysBetween` function looks for any information that falls in between two dates and takes two dates as arguments.
The query time ranges that are available are `_DateTime.ageInDays` , `_DateTime.ageInMonths` , `_DateTime.ageInYears` , and `_DateTime.daysBetween` . The `_DateTime.daysBetween` function looks for any information that falls in between two dates and takes two dates as arguments.
For example, the `_DateTime.ageInDays` returns the number of days until a date as a negative number.
[NOTE]
====
When using the _DateTime function all json parameters are available as auto-complete options, you must select only parameters that have timestamps. Also, the syntax for a function does not support spaces. Remove empty spaces before or after parenthesis, and between comma-separated parameters.
* For your query to work properly, ensure RQL json.rule functions are wrapped in single quotes (``). If single quotes are not added, the RQL will not be valid and cannot be executed.
* When using the _DateTime function all json parameters are available as auto-complete options, you must select only parameters that have timestamps. The syntax for a function does not support spaces, so make sure to remove empty spaces before or after parenthesis, and also between comma-separated parameters.
====
[cols="49%a,51%a"]
Expand Down

0 comments on commit 7ee3017

Please sign in to comment.