Devo SOAR - unionAll

Combine (create the union) of the tables listed in the arguments.

For example: instead of writing following LQL command to combine multiple tables:

LQL command

select * from cloudtrail union
select * from github union
select * from windows union
select * from vpc

you can use the unionAll operator.

LQL command

unionAll(cloudtrail, github, windows, vpc)

Note: unionAll operator will union tables even if they have different schemas, columns, types:

different columns: it will add empty columns to the table that doesnt contain that column
different types: it will convert different types with same column name to string
that it will perform join

Operator Usage in Easy Mode

Click + on the parent node.
Enter the Union All operator in the search field and select the operator from the Results to open the operator form.
In the Base Table drop-down, enter or select a node.
Optional. Click Show Optional Field to union with another input table. In the Union With drop-down, enter or select single or multiple nodes.
Click Run to view the result.
Click Cancel to discard the operator form.
Click Submit to add the operator to the playbook.

Usage Details

``` {text}unionAll(tables)

**Input**  
`tables`: List of tables to combine

**Output**  
Union of all tables

## Example

**Input**  
table1

&lt;div&gt;&lt;table class="blueTable"&gt;
&lt;thead&gt;
&lt;tr&gt;
&lt;th&gt;source_ip&lt;/th&gt;
&lt;th&gt;source_port&lt;/th&gt;
&lt;/tr&gt;
&lt;/thead&gt;
&lt;tbody&gt;
&lt;tr&gt;
&lt;td&gt;1.1.1.1&lt;/td&gt;&lt;td&gt;111&lt;/td&gt;&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;3.3.3.3&lt;/td&gt;&lt;td&gt;333&lt;/td&gt;&lt;/tr&gt;
&lt;/tbody&gt;
&lt;/tr&gt;
&lt;/table&gt;&lt;/div&gt;

table2

&lt;div&gt;&lt;table class="blueTable"&gt;
&lt;thead&gt;
&lt;tr&gt;
&lt;th&gt;source_ip&lt;/th&gt;
&lt;th&gt;source_port&lt;/th&gt;
&lt;/tr&gt;
&lt;/thead&gt;
&lt;tbody&gt;
&lt;tr&gt;
&lt;td&gt;2.2.2.2&lt;/td&gt;&lt;td&gt;222&lt;/td&gt;&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;4.4.4.4&lt;/td&gt;&lt;td&gt;444&lt;/td&gt;&lt;/tr&gt;
&lt;/tbody&gt;
&lt;/tr&gt;
&lt;/table&gt;&lt;/div&gt;

&lt;style&gt;table.blueTable {
  border: 1px solid #1C6EA4;
  background-color: #FFFFFF;
  width: 100%;
  text-align: left;
  border-collapse: collapse;
}
table.blueTable td, table.blueTable th {
  border: 1px solid #AAAAAA;
  padding: 3px 2px;
}
table.blueTable tbody td {
  font-size: 13px;
}
table.blueTable thead {
  background: #E0E0E0;
  background: -moz-linear-gradient(top, #e8e8e8 0%, #e3e3e3 66%, #E0E0E0 100%);
  background: -webkit-linear-gradient(top, #e8e8e8 0%, #e3e3e3 66%, #E0E0E0 100%);
  background: linear-gradient(to bottom, #e8e8e8 0%, #e3e3e3 66%, #E0E0E0 100%);
  border-bottom: 1px solid #444444;
}
table.blueTable thead th {
  font-size: 15px;
  font-weight: bold;
  color: #424242;
  border-left: 1px solid #D0E4F5;
}
table.blueTable thead th:first-child {
  border-left: none;
}

table.blueTable tfoot td {
  font-size: 14px;
}
table.blueTable tfoot .links {
  text-align: right;
}
table.blueTable tfoot .links a{
  display: inline-block;
  background: #1C6EA4;
  color: #FFFFFF;
  padding: 2px 8px;
  border-radius: 5px;
}&lt;/style&gt;

LQL command
``` {sql}
unionAll(table1, table2)

Output

source_id	source_port
1.1.1.1	111
3.3.3.3	333
2.2.2.2	222
4.4.4.4	444