Create an XQL Query - Administrator Guide - Cortex XSIAM - Cortex

Create an XQL Query - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Administrator Guide

Product

Cortex XSIAM

Creation date

2024-05-06

Last date published

2024-09-09

Note

For further help constructing queries, use the XQL Language Reference Guide.

Create a Data Model Query

From Cortex XSIAM, select Incident Response → Investigation → Query Builder.
Click XQL.
(Optional) To change the default time period against which to run your query, at the top right of the window, select the required time period, or create a customized one.
(Optional) To translate Splunk queries to XQL queries, enable Translate to XQL. If you choose to use this feature, enter your Splunk query in the Splunk field, click the arrow icon to convert to XQL, and then go to Step 6.
Create your query by typing in the query field. Relevant commands, their definitions, and operators are suggested as you type. When multiple suggestions are displayed, use the arrow keys to select a suggestion and to view an explanation for each one.
1. Specify the datasets to run your query against by typing either datamodel dataset = <dataset name>... or datamodel dataset in (<dataset name>,...).... For example:
```
datamodel dataset in (amazon_aws_raw)
```
  Note
  While datamodel dataset=* is supported in the query, we recommend that you specify specific datasets for quicker and more efficient results.
2. Press Enter, and then type the pipe character (|). Select a stage, and complete the stage syntax using the suggested options.
3. Continue adding stages until your query is complete. For example:
```
datamodel dataset in (amazon_aws_raw)
    | filter xdm.source.ipv4 = "10.9.165.1"
    | fields xdm.source.ipv4, xdm.source.port
    | limit 100  
```
Choose when to run your query:
- Run the query immediately.
- Run the query by the specified date and time, or on a specific date, by selecting the calendar icon ().
(Optional) The Save As options save your query for future use:
1. BIOC Rule: When compatible, saves the query as a BIOC rule. The XQL query must contain a filter for the event_type field.
2. Correlation Rule
3. Query to Library: Saves the query to your personal query library.
4. Widget to Library: For more information, see View XQL Query Results.

Tip

While the query is running, you can navigate away from the page. A notification is sent when the query has finished. You can also Cancel the query or run a new query, where you have the option to Run only new query (cancel previous) or Run both queries.

Create a Dataset Query

From Cortex XSIAM, select Incident Response → Investigation → Query Builder.
Click XQL.
(Optional) To change the default time period against which to run your query, at the top right of the window, select the required time period, or create a customized one.
(Optional) To translate Splunk queries to XQL queries, enable Translate to XQL. If you choose to use this feature, enter your Splunk query in the Splunk field, click the arrow icon to convert to XQL, and then go to Step 6.
Create your query by typing in the query field. Relevant commands, their definitions, and operators are suggested as you type. When multiple suggestions are displayed, use the arrow keys to select a suggestion and to view an explanation for each one.
1. Specify a dataset. For example:
```
dataset = xdr_data
```
2. Press Enter, and then type the pipe character (|). Select a command, and complete the command using the suggested options.
3. Continue adding stages until your query is complete. For example:
```
dataset = xdr_data 
| filter agent_os_type = ENUM.AGENT_OS_MAC
| limit 250  
```
Choose when to run your query:
- Run the query immediately.
- Run the query by the specified date and time, or on a specific date, by selecting the calendar icon ().
(Optional) The Save As options save your query for future use:
1. BIOC Rule: When compatible, saves the query as a BIOC rule. The XQL query must contain a filter for the event_type field.
2. Correlation Rule
3. Query to Library: Saves the query to your personal query library.
4. Widget to Library: For more information, see View XQL Query Results.