Create an XQL Query - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Administrator Guide

Product
Cortex XSIAM
Creation date
2024-05-06
Last date published
2024-07-12
Category
Administrator Guide
Abstract

Learn how to create queries using the Cortex Query Language (XQL).

Use XQL Search to analyze raw log data stored in Cortex XSIAM. You can query either the Cortex Data Model (XDM) or a dataset, using the following syntax, respectively:

  • XDM

    datamodel dataset = <dataset name>...
        | <STAGE> ...
        | <STAGE> ...
        | <STAGE> ...

    or

    datamodel dataset in (<dataset name>,...)...
        | <STAGE> ...
        | <STAGE> ...
        | <STAGE> ...
  • Dataset

    dataset = <DATASET NAME>
        | <STAGE> ...
        | <STAGE> ...
        | <STAGE> ...

    or

    dataset in (<DATASET NAME>)
        | <STAGE> ...
        | <STAGE> ...
        | <STAGE> ...

Note

For further help constructing queries, use the XQL Language Reference Guide.

Create a Data Model Query
  1. From Cortex XSIAM, select Incident ResponseInvestigationQuery Builder.

  2. Click XQL.

  3. (Optional) To change the default time period against which to run your query, at the top right of the window, select the required time period, or create a customized one.

  4. (Optional) To translate Splunk queries to XQL queries, enable Translate to XQL. If you choose to use this feature, enter your Splunk query in the Splunk field, click the arrow icon to convert to XQL, and then go to Step 6.

  5. Create your query by typing in the query field. Relevant commands, their definitions, and operators are suggested as you type. When multiple suggestions are displayed, use the arrow keys to select a suggestion and to view an explanation for each one.

    1. Specify the datasets to run your query against by typing either datamodel dataset = <dataset name>... or datamodel dataset in (<dataset name>,...).... For example:

      datamodel dataset in (amazon_aws_raw)

      Note

      While datamodel dataset=* is supported in the query, we recommend that you specify specific datasets for quicker and more efficient results.

    2. Press Enter, and then type the pipe character (|). Select a stage, and complete the stage syntax using the suggested options.

    3. Continue adding stages until your query is complete. For example:

      datamodel dataset in (amazon_aws_raw)
          | filter xdm.source.ipv4 = "10.9.165.1"
          | fields xdm.source.ipv4, xdm.source.port
          | limit 100  
  6. Choose when to run your query:

    • Run the query immediately.

    • Run the query by the specified date and time, or on a specific date, by selecting the calendar icon (query-calendar-icon.png).

  7. (Optional) The Save As options save your query for future use:

    1. BIOC Rule: When compatible, saves the query as a BIOC rule. The XQL query must contain a filter for the event_type field.

    2. Correlation Rule

    3. Query to Library: Saves the query to your personal query library.

    4. Widget to Library: For more information, see View XQL Query Results.

Tip

While the query is running, you can navigate away from the page. A notification is sent when the query has finished. You can also Cancel the query or run a new query, where you have the option to Run only new query (cancel previous) or Run both queries.

Create a Dataset Query
  1. From Cortex XSIAM, select Incident ResponseInvestigationQuery Builder.

  2. Click XQL.

  3. (Optional) To change the default time period against which to run your query, at the top right of the window, select the required time period, or create a customized one.

  4. (Optional) To translate Splunk queries to XQL queries, enable Translate to XQL. If you choose to use this feature, enter your Splunk query in the Splunk field, click the arrow icon to convert to XQL, and then go to Step 6.

  5. Create your query by typing in the query field. Relevant commands, their definitions, and operators are suggested as you type. When multiple suggestions are displayed, use the arrow keys to select a suggestion and to view an explanation for each one.

    1. Specify a dataset. For example:

      dataset = xdr_data
    2. Press Enter, and then type the pipe character (|). Select a command, and complete the command using the suggested options.

    3. Continue adding stages until your query is complete. For example:

      dataset = xdr_data 
      | filter agent_os_type = ENUM.AGENT_OS_MAC
      | limit 250  
  6. Choose when to run your query:

    • Run the query immediately.

    • Run the query by the specified date and time, or on a specific date, by selecting the calendar icon (query-calendar-icon.png).

  7. (Optional) The Save As options save your query for future use:

    1. BIOC Rule: When compatible, saves the query as a BIOC rule. The XQL query must contain a filter for the event_type field.

    2. Correlation Rule

    3. Query to Library: Saves the query to your personal query library.

    4. Widget to Library: For more information, see View XQL Query Results.

Tip

While the query is running, you can navigate away from the page. A notification is sent when the query has finished. You can also Cancel the query or run a new query, where you have the option to Run only new query (cancel previous) or Run both queries.