# PantherFlow Expressions

{% hint style="info" %}
PantherFlow is in open beta starting with Panther version 1.110, and is available to all customers. Please share any bug reports and feature requests with your Panther support team.
{% endhint %}

## References

### Array references

<table><thead><tr><th width="173.33333333333331">Syntax</th><th width="200">Description</th><th>Example</th></tr></thead><tbody><tr><td><code>array[X]</code></td><td>Retrieve value at X</td><td><code>foo[1]</code></td></tr></tbody></table>

### Object references

<table><thead><tr><th width="173.33333333333331">Syntax</th><th width="200">Description</th><th>Example</th></tr></thead><tbody><tr><td><code>object['X']</code></td><td>Retrieve value at X</td><td><code>foo['bar']</code></td></tr><tr><td><code>object.X</code></td><td>Retrieve value at X</td><td><code>foo.bar</code></td></tr></tbody></table>

## Comparisons

### Equality comparisons

<table><thead><tr><th width="145.33333333333331">Operator</th><th width="172">Description</th><th>Example</th><th data-hidden>Operator</th><th data-hidden>Meaning</th></tr></thead><tbody><tr><td><code>==</code></td><td>Equality</td><td><code>A == B</code></td><td>==</td><td></td></tr><tr><td><code>!=</code></td><td>Inequality</td><td><code>A != B</code></td><td>!=</td><td></td></tr></tbody></table>

### Boolean comparisons

<table><thead><tr><th width="149.33333333333331">Operator</th><th width="158">Description</th><th>Example</th><th data-hidden>Operator</th><th data-hidden>Meaning</th></tr></thead><tbody><tr><td><code>and</code></td><td>Logical and</td><td><code>A and B</code></td><td>and</td><td></td></tr><tr><td><code>or</code></td><td>Logical or</td><td><code>A or B</code></td><td>or</td><td></td></tr><tr><td><code>not</code></td><td>Logical not</td><td><code>not A</code></td><td>not</td><td></td></tr></tbody></table>

### Numerical comparisons

<table><thead><tr><th width="126.33333333333331">Syntax</th><th width="245">Description</th><th>Example</th></tr></thead><tbody><tr><td><code>&#x3C;</code></td><td>Less than</td><td><code>A &#x3C; B</code></td></tr><tr><td><code>&#x3C;=</code></td><td>Less than or equal to</td><td><code>A &#x3C;= B</code></td></tr><tr><td><code>></code></td><td>Greater than</td><td><code>A > B</code></td></tr><tr><td><code>>=</code></td><td>Greater than or equal to</td><td><code>A >= B</code></td></tr><tr><td><code>+</code></td><td>Add</td><td><code>A + B</code></td></tr><tr><td><code>-</code></td><td>Subtract</td><td><code>A - B</code></td></tr><tr><td><code>*</code></td><td>Multiply</td><td><code>A * B</code></td></tr><tr><td><code>/</code></td><td>Divide</td><td><code>A / B</code></td></tr><tr><td><code>%</code></td><td>Modulo</td><td><code>A % B</code></td></tr></tbody></table>

### Array comparisons

<table><thead><tr><th width="142.33333333333331">Syntax</th><th width="194">Description</th><th>Example</th></tr></thead><tbody><tr><td><code>in</code></td><td>Value is in array</td><td><code>X in [X, Y, Z]</code>, <code>'10.10.10.100' in p_any_ip_addresses</code></td></tr><tr><td><code>not in</code></td><td>Value is not in array</td><td><code>X not in [A, B, C]</code></td></tr></tbody></table>

### Between comparisons

<table><thead><tr><th width="166">Operator</th><th width="248">Description</th><th>Example</th></tr></thead><tbody><tr><td><code>between</code></td><td>Value is between two values (inclusive), which are separated by <code>..</code></td><td><code>&#x3C;foo> between &#x3C;begin> .. &#x3C;end></code></td></tr><tr><td><code>not between</code></td><td>Value is not between two values (exclusive), which are separated by <code>..</code></td><td><code>&#x3C;foo> not between &#x3C;begin> .. &#x3C;end></code></td></tr></tbody></table>

## Functions

### Anonymous functions

An anonymous function, or "lambda function," is an unnamed function that can be used as an argument to the `arrays.map()` and `arrays.filter()` functions. Anonymous functions have zero or more parameters and a body that is an expression:

```kusto
fn ([arg1] [, arg2...]]) { <expr> }
```

#### Example: **Add one to a number in `arrays.map()`**

In the example below, the anonymous function is applied to each of the elements in the array provided as the first argument to `arrays.map()`:

```kusto
arrays.map([1, 2, 3], fn (r) { r + 1 })
```

After `arrays.map()` applies the function on each element, the array becomes:

```kusto
[2, 3, 4]
```

#### **Example: Compare to null in `arrays.filter()`**

In the example below, `arrays.filter()` uses the anonymous function as the filter condition:

```kusto
arrays.filter([null, 5, null, 6], fn (elem) { elem != null })
```

After `arrays.filter()` filters the list using the anonymous function, it becomes:

```kusto
[5, 6]
```

#### **Example: Nest multiple anonymous functions**

It's possible to nest anonymous functions, or use an anonymous function in the body of another anonymous function. This can be useful for extracting arrays within arrays:

```kusto
let source = datatable [{
  "results": [
    {
      "cats": [
        {
          "Name": "Whiskers",
          "Breed": "Siamese",
          "FurLength": "Short",
          "ID": "AAAAA"
        },
        {
          "Name": "Mittens",
          "Breed": "Maine Coon",
          "FurLength": "Long",
          "ID": "BBBBB"
        }
      ]
    },
    {
      "cats": [
        {
          "Name": "Mr. Meow",
          "Breed": "Orange Tabby",
          "FurLength": "Short",
          "ID": "CCCCC"
        },
        {
          "Name": "Mrs. Meow",
          "Breed": "Persian",
          "FurLength": "Long",
          "ID": "DDDDD"
        }
      ]
    }
  ]
}];

source
| project results=arrays.flatten(
    arrays.map(results, fn (result) { 
        arrays.map(result.cats, fn (cat) { 
            object("CatName", cat.Name, "ID", cat.ID) 
        })
    })
)
```

| results                                                                                                                                             |
| --------------------------------------------------------------------------------------------------------------------------------------------------- |
| `[{"CatName":"Whiskers","ID":"AAAAA"},{"CatName":"Mittens","ID":"BBBBB"},{"CatName":"Mr. Meow","ID":"CCCCC"},{"CatName":"Mrs. Meow","ID":"DDDDD"}]` |


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.panther.com/pantherflow/expressions.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.