Create XQL query - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

From Cortex XSIAM, select Incident Response → Investigation → Query Builder.

Click XQL.

(Optional) To change the default time period against which to run your query, at the top right of the window, select the required time period, or create a customized one.

(Optional) To translate Splunk queries to XQL queries, enable Translate to XQL. If you choose to use this feature, enter your Splunk query in the Splunk field, click the arrow icon to convert to XQL, and then go to Step 6.

Create your query by typing in the query field. Relevant commands, their definitions, and operators are suggested as you type. When multiple suggestions are displayed, use the arrow keys to select a suggestion and to view an explanation for each one.

1. Specify the datasets to run your query against by typing either datamodel dataset = <dataset name>... or datamodel dataset in (<dataset name>,...).... For example:

   datamodel dataset in (amazon_aws_raw)

   Note

   While datamodel dataset=* is supported in the query, we recommend that you specify specific datasets for quicker and more efficient results.

2. Press Enter, and then type the pipe character (|). Select a stage, and complete the stage syntax using the suggested options.

3. Continue adding stages until your query is complete. For example:

   datamodel dataset in (amazon_aws_raw)
       | filter xdm.source.ipv4 = "10.9.165.1"
       | fields xdm.source.ipv4, xdm.source.port
       | limit 100  

Choose when to run your query:

(Optional) The Save As options save your query for future use:

From Cortex XSIAM, select Incident Response → Investigation → Query Builder.

Click XQL.

(Optional) To change the default time period against which to run your query, at the top right of the window, select the required time period, or create a customized one.

(Optional) To translate Splunk queries to XQL queries, enable Translate to XQL. If you choose to use this feature, enter your Splunk query in the Splunk field, click the arrow icon () to convert to XQL, and then go to Step 6.

Create your query by typing in the query field. Relevant commands, their definitions, and operators are suggested as you type. When multiple suggestions are displayed, use the arrow keys to select a suggestion and to view an explanation for each one.

1. (Optional) Specify a dataset.

   You only need to specify a dataset if you are running your query against a dataset that you have not set as default. Otherwise, the query runs against the xdr_data dataset. For more information, see How to build XQL queries.

   Example 123. 

   dataset = xdr_data

   
   

2. Press Enter, and then type the pipe character (|). Select a command, and complete the command using the suggested options.

3. Continue adding stages until your query is complete.

   Example 124. 

   dataset = xdr_data 
   | filter agent_os_type = ENUM.AGENT_OS_MAC
   | limit 250  

   
   

Choose when to run your query:

(Optional) The Save As options save your query for future use: