CEL Overloads

The where The field in rules and filters relies on a customized variant of the Common Expression Language (CEL). This differs from standard CEL, which uses method-call syntax (for example, field.contains()), Unified Security Stack uses functional overloads that are more secure and automatically manage absent fields.

Available Overloads

Core Features

Type Flexibility: Functions like equals and oneOf carry out best-effort matching. They automatically handle comparisons between strings and numbers (such as, equals("f", 100) will match both the integer 100 and the string "100").
Strict String Safety: Functions designed for string manipulation (startsWith, contains, regexMatch, and so on) strictly require the field value to be a string. This stops false positives on numeric or boolean fields.
Auto-Existence: If a field is missing, these functions return false rather than causing the expression to crash or produce an error.

Category	Function	Field Type (Log)	Literal Type (Rule)	Description
Existence	exists("f")	Any	N/A	Verifies the presence of a field.
Logic	safe("f", def)	String, Num, Bool	Matches Field	Provides field value or def when absent.
Flexible Match	equals("f", val)	String, Num	String, Int, Double	Best-effort equality. It matches even when types differ (str vs num).
	oneOf("f", [...])	Any	List of Any	True when field matches any item through flexible matching.
Strict String	equalsIgnoreCase("f", "v")	String	String	Performs case-insensitive equality comparison.
(Scalar Only)	contains("f", "v")	String	String or List	True when field holds one or more substrings.
	containsAll("f", [...])	String	List of Strings	True when field holds every substring.
	startsWith("f", "v")	String	String or List	True when field starts with one or more prefixes.
	endsWith("f", "v")	String	String or List	True when field ends with one or more suffixes.
	regexMatch("f", "re")	String	String (Regex)	Checks field against a regex.
Network	inCIDR("f", "net")	String (IP)	String (CIDR)	IPv4/v6 inside a CIDR range.
Comparison	greaterThan("f", val)	Number	String, Int, Double	True if field is greater than value (converts strings to num when possible).
	lessThan("f", val)	Number	String, Int, Double	Returns true when the field is less than value.
	greaterOrEqual("f", val)	Number	String, Int, Double	Returns true when the field is less than value.
	lessOrEqual("f", val)	Number	String, Int, Double	Returns true when the field is less than value.
Temporal	isHour("f", val)	String (ISO8601)	Int (0-23)	Returns true when the hour matches val.
	isMinute("f", val)	String (ISO8601)	Int (0-59)	Returns true when the minute matches val.
	isDayOfWeek("f", val)	String (ISO8601)	Int (0-6)	True when day (0=Sun) equals val.
	isWeekend("f")	String (ISO8601)	N/A	Returns true for Saturday or Sunday.
	isWorkDay("f")	String (ISO8601)	N/A	Returns true for Monday through Friday.
	isBetweenTime("f", "start", "end")	String (ISO8601)	String ("HH:MM")	Returns true if within the specified range.

Example: Multi-Condition Detection

where: >
  exists("origin.ip") && 
  !inCIDR("origin.ip", "10.0.0.0/8") && 
  (startsWith("origin.user", "admin_") || equals("origin.user", "root"))