Feature: Semver Function

artifacts/testdata/server/testcases/semver.in.yaml

@@ -0,0 +1,49 @@
+Queries:
+  # Test function output format
+  - SELECT semver(version="v1.2.3-dev") FROM scope()
+
+  # Test comparison against version strings
+  - SELECT
+      semver(version="1.2.3") = "1.2.3",
+      semver(version="1.2.3") != "1.0.0",
+      semver(version="1.2.3") > "0.1.0",
+      semver(version="1.2.3") >= "0.1.0",
+      semver(version="1.2.3") < "2.0.0",
+      semver(version="1.2.3") <= "2.0.0"
+    FROM scope()
+
+  # Test comparison against semver outputs 
+  - SELECT
+      semver(version="1.2.3") = semver(version="1.2.3"),
+      semver(version="1.2.3") != semver(version="1.0.0"),
+      semver(version="1.2.3") > semver(version="0.1.0"),
+      semver(version="1.2.3") >= semver(version="0.1.0"),
+      semver(version="1.2.3") < semver(version="2.0.0"),
+      semver(version="1.2.3") <= semver(version="2.0.0")
+    FROM scope()
+
+  # Test comparison against partial version strings
+  - SELECT
+      semver(version="1.0.0") = "1",
+      semver(version="1.1.0") = "1.1",
+      semver(version="1.1") = "1.1",
+      semver(version="1") = "1.0.0",
+      semver(version="1") != "1.0.1",
+      semver(version="2.5.1") >= "2.5",
+      semver(version="2.5") < "3.0"
+    FROM scope()
+
+  # Test invalid semantic version arguments (should be null)
+  - SELECT
+      semver(version=""),
+      semver(version="invalid")
+    FROM scope()
+
+  # Test comparison against invalid versions (should be false)
+  - SELECT
+      semver(version="1.0.0") = "",
+      semver(version="1.0.0") = "invalid",
+      semver(version="1.0.0") > "invalid",
+      semver(version="1.0.0") < "invalid",
+      semver(version="1.0.0") = 1
+    FROM scope()

artifacts/testdata/server/testcases/semver.out.yaml

@@ -0,0 +1,75 @@
+# Test function output format
+Query: SELECT semver(version="v1.2.3-dev") FROM scope()
+Output: [
+ {
+  "semver(version=\"v1.2.3-dev\")": {
+   "Major": 1,
+   "Minor": 2,
+   "Patch": 3,
+   "Prerelease": "dev",
+   "Version": "1.2.3-dev"
+  }
+ }
+]
+
+# Test comparison against version strings
+Query: SELECT semver(version="1.2.3") = "1.2.3", semver(version="1.2.3") != "1.0.0", semver(version="1.2.3") > "0.1.0", semver(version="1.2.3") >= "0.1.0", semver(version="1.2.3") < "2.0.0", semver(version="1.2.3") <= "2.0.0" FROM scope()
+Output: [
+ {
+  "semver(version=\"1.2.3\") = \"1.2.3\"": true,
+  "semver(version=\"1.2.3\") != \"1.0.0\"": true,
+  "semver(version=\"1.2.3\") \u003e \"0.1.0\"": true,
+  "semver(version=\"1.2.3\") \u003e= \"0.1.0\"": true,
+  "semver(version=\"1.2.3\") \u003c \"2.0.0\"": true,
+  "semver(version=\"1.2.3\") \u003c= \"2.0.0\"": true
+ }
+]
+
+# Test comparison against semver outputs 
+Query: SELECT semver(version="1.2.3") = semver(version="1.2.3"), semver(version="1.2.3") != semver(version="1.0.0"), semver(version="1.2.3") > semver(version="0.1.0"), semver(version="1.2.3") >= semver(version="0.1.0"), semver(version="1.2.3") < semver(version="2.0.0"), semver(version="1.2.3") <= semver(version="2.0.0") FROM scope()
+Output: [
+ {
+  "semver(version=\"1.2.3\") = semver(version=\"1.2.3\")": true,
+  "semver(version=\"1.2.3\") != semver(version=\"1.0.0\")": true,
+  "semver(version=\"1.2.3\") \u003e semver(version=\"0.1.0\")": true,
+  "semver(version=\"1.2.3\") \u003e= semver(version=\"0.1.0\")": true,
+  "semver(version=\"1.2.3\") \u003c semver(version=\"2.0.0\")": true,
+  "semver(version=\"1.2.3\") \u003c= semver(version=\"2.0.0\")": true
+ }
+]
+
+# Test comparison against partial version strings
+Query: SELECT semver(version="1.0.0") = "1", semver(version="1.1.0") = "1.1", semver(version="1.1") = "1.1", semver(version="1") = "1.0.0", semver(version="1") != "1.0.1", semver(version="2.5.1") >= "2.5", semver(version="2.5") < "3.0" FROM scope()
+Output: [
+ {
+  "semver(version=\"1.0.0\") = \"1\"": true,
+  "semver(version=\"1.1.0\") = \"1.1\"": true,
+  "semver(version=\"1.1\") = \"1.1\"": true,
+  "semver(version=\"1\") = \"1.0.0\"": true,
+  "semver(version=\"1\") != \"1.0.1\"": true,
+  "semver(version=\"2.5.1\") \u003e= \"2.5\"": true,
+  "semver(version=\"2.5\") \u003c \"3.0\"": true
+ }
+]
+
+# Test invalid semantic version arguments (should be null)
+Query: SELECT semver(version=""), semver(version="invalid") FROM scope()
+Output: [
+ {
+  "semver(version=\"\")": null,
+  "semver(version=\"invalid\")": null
+ }
+]
+
+# Test comparison against invalid versions (should be false)
+Query: SELECT semver(version="1.0.0") = "", semver(version="1.0.0") = "invalid", semver(version="1.0.0") > "invalid", semver(version="1.0.0") < "invalid", semver(version="1.0.0") = 1 FROM scope()
+Output: [
+ {
+  "semver(version=\"1.0.0\") = \"\"": false,
+  "semver(version=\"1.0.0\") = \"invalid\"": false,
+  "semver(version=\"1.0.0\") \u003e \"invalid\"": false,
+  "semver(version=\"1.0.0\") \u003c \"invalid\"": false,
+  "semver(version=\"1.0.0\") = 1": false
+ }
+]
+

docs/references/vql.yaml

@@ -9318,6 +9318,21 @@
   platforms:
   - linux_amd64_cgo
   - windows_amd64_cgo
+- name: semver
+  description: Parse a semantic version string.
+  type: Function
+  version: 1
+  args:
+  - name: version
+    type: string
+    description: A string to convert to a semantic version
+    required: true
+  platforms:
+  - darwin_amd64_cgo
+  - darwin_arm64_cgo
+  - linux_amd64_cgo
+  - windows_386_cgo
+  - windows_amd64_cgo
 - name: send_event
   description: |
     Sends an event to a server event monitoring queue.