# PantherFlow Expressions

{% hint style="info" %}
PantherFlow is in open beta starting with Panther version 1.110, and is available to all customers. Please share any bug reports and feature requests with your Panther support team.
{% endhint %}

## References

### Array references

<table><thead><tr><th width="173.33333333333331">Syntax</th><th width="200">Description</th><th>Example</th></tr></thead><tbody><tr><td><code>array[X]</code></td><td>Retrieve value at X</td><td><code>foo[1]</code></td></tr></tbody></table>

### Object references

<table><thead><tr><th width="173.33333333333331">Syntax</th><th width="200">Description</th><th>Example</th></tr></thead><tbody><tr><td><code>object['X']</code></td><td>Retrieve value at X</td><td><code>foo['bar']</code></td></tr><tr><td><code>object.X</code></td><td>Retrieve value at X</td><td><code>foo.bar</code></td></tr></tbody></table>

## Comparisons

### Equality comparisons

<table><thead><tr><th width="145.33333333333331">Operator</th><th width="172">Description</th><th>Example</th><th data-hidden>Operator</th><th data-hidden>Meaning</th></tr></thead><tbody><tr><td><code>==</code></td><td>Equality</td><td><code>A == B</code></td><td>==</td><td></td></tr><tr><td><code>!=</code></td><td>Inequality</td><td><code>A != B</code></td><td>!=</td><td></td></tr></tbody></table>

### Boolean comparisons

<table><thead><tr><th width="149.33333333333331">Operator</th><th width="158">Description</th><th>Example</th><th data-hidden>Operator</th><th data-hidden>Meaning</th></tr></thead><tbody><tr><td><code>and</code></td><td>Logical and</td><td><code>A and B</code></td><td>and</td><td></td></tr><tr><td><code>or</code></td><td>Logical or</td><td><code>A or B</code></td><td>or</td><td></td></tr><tr><td><code>not</code></td><td>Logical not</td><td><code>not A</code></td><td>not</td><td></td></tr></tbody></table>

### Numerical comparisons

<table><thead><tr><th width="126.33333333333331">Syntax</th><th width="245">Description</th><th>Example</th></tr></thead><tbody><tr><td><code>&#x3C;</code></td><td>Less than</td><td><code>A &#x3C; B</code></td></tr><tr><td><code>&#x3C;=</code></td><td>Less than or equal to</td><td><code>A &#x3C;= B</code></td></tr><tr><td><code>></code></td><td>Greater than</td><td><code>A > B</code></td></tr><tr><td><code>>=</code></td><td>Greater than or equal to</td><td><code>A >= B</code></td></tr><tr><td><code>+</code></td><td>Add</td><td><code>A + B</code></td></tr><tr><td><code>-</code></td><td>Subtract</td><td><code>A - B</code></td></tr><tr><td><code>*</code></td><td>Multiply</td><td><code>A * B</code></td></tr><tr><td><code>/</code></td><td>Divide</td><td><code>A / B</code></td></tr><tr><td><code>%</code></td><td>Modulo</td><td><code>A % B</code></td></tr></tbody></table>

### Array comparisons

<table><thead><tr><th width="142.33333333333331">Syntax</th><th width="194">Description</th><th>Example</th></tr></thead><tbody><tr><td><code>in</code></td><td>Value is in array</td><td><code>X in [X, Y, Z]</code>, <code>'10.10.10.100' in p_any_ip_addresses</code></td></tr><tr><td><code>not in</code></td><td>Value is not in array</td><td><code>X not in [A, B, C]</code></td></tr></tbody></table>

### Between comparisons

<table><thead><tr><th width="166">Operator</th><th width="248">Description</th><th>Example</th></tr></thead><tbody><tr><td><code>between</code></td><td>Value is between two values (inclusive), which are separated by <code>..</code></td><td><code>&#x3C;foo> between &#x3C;begin> .. &#x3C;end></code></td></tr><tr><td><code>not between</code></td><td>Value is not between two values (exclusive), which are separated by <code>..</code></td><td><code>&#x3C;foo> not between &#x3C;begin> .. &#x3C;end></code></td></tr></tbody></table>

## Functions

### Anonymous functions

An anonymous function, or "lambda function," is an unnamed function that can be used as an argument to the `arrays.map()` and `arrays.filter()` functions. Anonymous functions have zero or more parameters and a body that is an expression:

```kusto
fn ([arg1] [, arg2...]]) { <expr> }
```

#### Example: **Add one to a number in `arrays.map()`**

In the example below, the anonymous function is applied to each of the elements in the array provided as the first argument to `arrays.map()`:

```kusto
arrays.map([1, 2, 3], fn (r) { r + 1 })
```

After `arrays.map()` applies the function on each element, the array becomes:

```kusto
[2, 3, 4]
```

#### **Example: Compare to null in `arrays.filter()`**

In the example below, `arrays.filter()` uses the anonymous function as the filter condition:

```kusto
arrays.filter([null, 5, null, 6], fn (elem) { elem != null })
```

After `arrays.filter()` filters the list using the anonymous function, it becomes:

```kusto
[5, 6]
```

#### **Example: Nest multiple anonymous functions**

It's possible to nest anonymous functions, or use an anonymous function in the body of another anonymous function. This can be useful for extracting arrays within arrays:

```kusto
let source = datatable [{
  "results": [
    {
      "cats": [
        {
          "Name": "Whiskers",
          "Breed": "Siamese",
          "FurLength": "Short",
          "ID": "AAAAA"
        },
        {
          "Name": "Mittens",
          "Breed": "Maine Coon",
          "FurLength": "Long",
          "ID": "BBBBB"
        }
      ]
    },
    {
      "cats": [
        {
          "Name": "Mr. Meow",
          "Breed": "Orange Tabby",
          "FurLength": "Short",
          "ID": "CCCCC"
        },
        {
          "Name": "Mrs. Meow",
          "Breed": "Persian",
          "FurLength": "Long",
          "ID": "DDDDD"
        }
      ]
    }
  ]
}];

source
| project results=arrays.flatten(
    arrays.map(results, fn (result) { 
        arrays.map(result.cats, fn (cat) { 
            object("CatName", cat.Name, "ID", cat.ID) 
        })
    })
)
```

| results                                                                                                                                             |
| --------------------------------------------------------------------------------------------------------------------------------------------------- |
| `[{"CatName":"Whiskers","ID":"AAAAA"},{"CatName":"Mittens","ID":"BBBBB"},{"CatName":"Mr. Meow","ID":"CCCCC"},{"CatName":"Mrs. Meow","ID":"DDDDD"}]` |