Cmd CQL (Command Query Language) defines your reports, triggers, and searches on the sessions page. This glossary lists the CQL properties available throughout the web app, as well as several important notes on usage.
CQL usage — syntax and best practices:
Cmd CQL values are only listed in the web interfaces where they are available for a particular query type (e.g., session trigger queries and searches of unresolved alerts have different vocabularies).
Do not attempt to escape characters using the backslash, e.g.:
Instead, escape characters with square brackets, e.g.:
Cmd CQL provides a number of ways to match characters. We recommend you learn the syntax.
The trigger best practices guide teaches some fundamental design principles to keep in mind when building triggers.