Common Expression Language (CEL) Overview🔗

Secureworks® Taegis™ XDR’s automations platform is compatible with Google’s Common Expression Language (CEL). You can embed CEL logic and data manipulation within connectors and templates. We have resources that can help you get started with CEL in Taegis.

Getting Started with CEL — See introductory information about CEL components.
Example Use Cases for CEL — Explore ways to use CEL in Taegis.
Supported CEL Macros — See common examples of CEL Macros used in Taegis.
CEL Explorer — Use a Taegis native tool to test CEL expressions.

Syntax🔗

Connectors🔗

In a connector, the CEL expression must be wrapped in ${}. For example:

${inputs.myvar}

Templates🔗

In a template, you can wrap the CEL expression in ${}, but it doesn’t have to be. For example, the following two statements do the same thing:

${inputs.myvar}

inputs.myvar

Note

In a template, single quoted text inside double quoted text is not evaluated in a CEL expression; it’s just left as plaintext.

For example, in:

"inputs.myvar 'preserve text' inputs.newvar"

inputs.myvar and inputs.newvar are evaluated, but 'preserve text' is not evaluated.

Playbook Inputs🔗

You must use the ${} notation when using a CEL expression as an input to a playbook.

Trigger Filter Criteria🔗

You must use the ${} notation when using a CEL expression in trigger filter criteria.