Function Operation

Functions are key part of the CrowdStrike Query Language as they provide the main method for manipulating the event set during a query. How functions are used, how parameters work, and where functions are located within the query are all important considerations:

  • Function Parameters

    Parameters to a function define what the function does and how it operates. For example, a parameter may configure which fields should be processed, how many events to return, or change the setting or operation of the function and how it works.

  • Function Location

    The location of a given function can be significant. Some functions must be used in a specific location, such as the start of the query, or before or after other queries.

  • Function Input/Output

    Different functions may alter the content of each, create new events, or change the event set during their operation.

  • Function Types

    Functions are broadly categorised into different types according to their impact in the query. Some types, such as aggregating functions, have special significance within the query language and impact the operation of the query and other functions within it. Understanding and identifying the different functions and their operation can help to determine how they can be combined.