---
title: "Is in (`in`, <-)"
canonical: "https://docs.devo.com/space/latest/95201087/Is%20in%20(%60in%60%2C%20%3C-)"
format: markdown
---
> Macro (toc)
## Description
Determine if at least one of the arguments is a member of a class defined by the final argument.
You can apply this operation either as a **Filter** or **Create field** operation:
| **Filter** | Checks for the presence of one or more values in a given string. The filter will identify those strings containing at least one of the indicated values.
You can also use this operation to filter IPv4 or IPv6 addresses that belong to a specific network prefix or array of network prefixes, using [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation. |
| --- | --- |
| **Create field** | Adds a new Boolean field. |
> ⚠️ This operation is case sensitive. Use the [Is in - case insensitive (weakin)](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95201126) operation if you need to apply this filter ignoring case.
> Macro (excerpt)
>
> ## Comparing the ``in`` and `has` operations
>
> These two operations do not support the same data types. When the data type is supported by both operations, the operations are the same except that the order of the arguments is different.
>
> All of these expressions return `true` because “string” is included in the longer string “class of strings”.
>
> ```
> from siem.logtrust.collector.counter group
> select
> `in`("foo","string","class of strings"), "string" <- "class of strings",
> has("class of strings","string","foo"), "class of strings" -> "string"
> ```
## How does it work in the search window?
Select **Filter **/** Create field **in the search window toolbar, then select the **Is in **operation. This operation requires at least two arguments:
- **Value** and **is in** if you select *string* values. Optionally, you can add as many **or also** arguments as you need.
- **IP** and in **net** if you select an *ip* field and a *net4* field, or enter it manually. Nets in the selected field or entered manually must follow the format *x.x.x.x/s *(CIDR)*.*
| **Argument** | **Data type** |
| --- | --- |
| **Value **/** IP **mandatory | *string / ip / ip6* |
| **or also** | *string* |
| **is in **/** in net** mandatory | *string / set / array / map / net4 / net6 / array of net4 / array of net6* |
The data type of the values in the new field is *boolean*.
### Example
In the `siem.logtrust.web.activity` table, we want to get only the events that contain the word *access*, *control**,* or both in the **headers** field. To do this, we will apply a **Filter **using the** Is in** operation.
The arguments needed for the filter are:
- **Value **- Click the pencil icon and enter *access*
- **or also** - Click the pencil icon and enter *control*
- **is in **- **headers** field
Click **Filter data** and you will see the following result:
Click **Create field** and follow the same steps to add a new Boolean field that shows *true *when the strings in the **uri** field contain *access, control*, or both.
## How does it work in LINQ?
These are the valid formats of the **Is in **operation:
- Two arguments: `string_value <- string_general`
- Two or more arguments: ``in`(string_value1, string_value2... string_general)`
- `ip <- net4`
- ``in`(ip, net4)`
### Strings
```
from demo.ecommerce.data
select `in`("product", "screen", uri) as product_screen_uri
```
You can also apply this operation using the `<-` operator.
```
from demo.ecommerce.data
select "product" <- uri as product_uri
```
### IP addresses
If an attacker has compromised an entire subnet, the network prefix can be used to search for logs relating to malicious activity, such as lateral movement. The following queries use the **Is in** operation to get the IP addresses in the **clientIpAddress** field that belong to the network prefix *48.126.91.0/24.*
```
from demo.ecommerce.data
where clientIpAddress <- 48.126.91.0/24
```
```
from demo.ecommerce.data
where `in`(clientIpAddress, 48.126.91.0/24)
```
### Sets and arrays
An analyst wants to determine what happened when a compromised user account attempted to authentication into different services. Using [Collect distinct](https://devodocs.atlassian.net/wiki/spaces/latest/pages/446234632), the analyst determines all the results of the authentication attempts. Using ``in``, the analyst checks if any of the attempts were successful, indicating the service was compromised.
```
from auth.all
//Compromised user account
where eq(user,"ttyt1@vital.com")
group by source
select collectdistinct(action) as set_actions,
//Did the user login?
`in`("LOGIN",set_actions) as successful_login
```
### Maps
An analyst is investigating brute force authentication attacks. The analyst has created a *map *relating user accounts to the number of authentication attempts. Then the analyst checks to see if a suspicious user account is one of the keys in the map.
```
from auth.all group
select bag(collect(user)) as map
select `in`("smithrobert@vital.com",map)
```
### Array of net6
An analyst has an array of network prefixes which are indicators of compromise. Using ``in``, the analyst determines if an IP is compromised by comparing it with all the network prefixes.
```
from demo.ecommerce.data
where isnotnull(clientIpAddress)
select str(clientIpAddress in mkarray(
net6("::ffff:286:0/104"),
net6("::ffff:2226:0/104")
)) as true_false_string,
ip6(clientIpAddress) as ip6
```
### Array of net4
```
from demo.ecommerce.data
where isnotnull(clientIpAddress)
select str(clientIpAddress in mkarray(
net4("1.1.1.1/4"),
net4("40.1.1.1/4")
))
```