Create an XQL Query - Administrator Guide - Cortex XSIAM - Cortex

Create an XQL Query - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Administrator Guide

Product

Cortex XSIAM

Creation date

2024-02-26

Last date published

2024-04-25

Note

For further help constructing queries, use the XQL Language Reference Guide.

Create a Data Model Query

From Cortex XSIAM, select Incident Response → Investigation → Query Builder.
Select XQL Search.
(Optional) To change the default time period against which to run your query, at the top right of the window, select the required time period, or create a customized one.
(Optional) To translate Splunk queries to XQL queries, enable Translate to XQL. If you choose to use this feature, enter your Splunk query in the Splunk field, click the arrow icon to convert to XQL, and then go to Step 6.
Create your query by typing in the query field. Relevant commands, their definitions, and operators are suggested as you type. When multiple suggestions are displayed, use the arrow keys to select a suggestion and to view an explanation for each one.
1. Type datamodel.
2. Optionally, specify one or more datasets. For example:
```
datamodel dataset in (xdr_data)
```
3. Press Enter, and then type the pipe character (|). Select a command, and complete the command using the suggested options.
4. Continue adding stages until your query is complete. For example:
```
datamodel dataset in (xdr_data)
    | filter xdm.source.ipv4 = "10.9.165.1"
    | fields xdm.source.ipv4, xdm.source.port
    | limit 100  
```
Choose when to run your query:
- Run the query immediately.
- Run the query by the specified date and time, or on a specific date, by selecting the calendar icon ().
(Optional) The Save As options save your query for future use:
1. BIOC Rule—when compatible, saves the query as a BIOC rule. The XQL query must contain a filter for the event_type field.
2. Correlation Rule.
3. Query to Library—saves the query to your personal query library.
4. Widget to Library—for more information, see View XQL Query Results.

Tip

While the query is running, you can navigate away from the page. A notification is sent when the query has finished. You can also Cancel the query or run a new query, where you have the option to Run only new query (cancel previous) or Run both queries.

Create a Dataset Query

From Cortex XSIAM, select Incident Response → Investigation → Query Builder.
Select XQL Search.
(Optional) To change the default time period against which to run your query, at the top right of the window, select the required time period, or create a customized one.
(Optional) To translate Splunk queries to XQL queries, enable Translate to XQL. If you choose to use this feature, enter your Splunk query in the Splunk field, click the arrow icon to convert to XQL, and then go to Step 6.
Create your query by typing in the query field. Relevant commands, their definitions, and operators are suggested as you type. When multiple suggestions are displayed, use the arrow keys to select a suggestion and to view an explanation for each one.
1. Specify a dataset. For example:
```
dataset = xdr_data
```
2. Press Enter, and then type the pipe character (|). Select a command, and complete the command using the suggested options.
3. Continue adding stages until your query is complete. For example:
```
dataset = xdr_data 
| filter agent_os_type = ENUM.AGENT_OS_MAC
| limit 250  
```
Choose when to run your query:
- Run the query immediately.
- Run the query by the specified date and time, or on a specific date, by selecting the calendar icon ().
(Optional) The Save As options save your query for future use:
1. BIOC Rule—when compatible, saves the query as a BIOC rule. The XQL query must contain a filter for the event_type field.
2. Correlation Rule.
3. Query to Library—saves the query to your personal query library.
4. Widget to Library—for more information, see View XQL Query Results.