How to build XQL queries - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

The Cortex Query Language (XQL) supports a single Cortex Data Model (XDM), which is a normalized data structure. Datasets are mapped to the XDM in 3 different ways:

For more information on the XDM Schema, specifically the fields, fieldsets, fields designated as ENUMS (CONST), and aliases, see the Cortex XSIAM Data Model Schema.

The basic syntax structure for querying the Cortex Data Model (XDM) is:

datamodel
    | <STAGE> ...
    | <STAGE> ...
    | <STAGE> ...

In a query using the datamodel command, unless specific datasets are specified, a query will run against all mapped datasets, which contain log information ingested by Cortex XSIAM. You can also install Marketplace Content Packs, or map an ingested dataset into the XDM, to query additional datasets.

In XDM queries that specify datasets, use either of the following syntax:

datamodel dataset in (<dataset_name>,...) …

or

datamodel dataset = <dataset_name> …

Adding a wildcard suffix (*) is supported in the <dataset_name>, which matches all datasets that are mapped to the data model and begin with the specified text. For example, datamodel dataset = xdr* or datamodel dataset in (xdr*).

When querying the XDM, fields that are not mapped to the XDM are accessible by <dataset>.<field>. They can be used at any stage of a datamodel query.

When creating XDM queries, auto-suggestions are available, according to the existing XDM fields.

In a dataset query, unless otherwise specified, the query runs against the xdr_data dataset, which contains all log information that Cortex XSIAM collects from all Cortex product agents, including EDR data, and PAN NGFW data. In a dataset query, if you are running your query against a dataset that has been set as default, there is no need to specify a dataset. Otherwise, specify a dataset in your query. The Dataset Queries lists the available datasets, depending on system configuration.

The basic syntax structure for querying datasets that are not mapped to the XDM is:

dataset = <dataset name> 
    | <stage1> ...
    | <stage2> ... 
    | <stage3> ...

or

dataset in (<dataset name>)
    | <stage1> ...
    | <stage2> ...
    | <stage3> ...

You can specify a dataset using one of the following formats, which is based on the data retention offerings available in Cortex XSIAM.

When using the hot storage default format, this returns every xdr_data record contained in your Cortex XSIAM instance over the time range that you provide to the Query Builder user interface. This can be a large amount of data, which may take a long time to retrieve. You can use a limit stage to specify how many records you want to retrieve.

There is no practical limit to the number of stages that you can specify. See Stages for information on all the supported stages.

In the xdr_data dataset, every user field included in the raw data for network, authentication, and login events has an equivalent normalized user field associated with it that displays the user information in the following standardized format:

<company domain>\<username>

For example, the login_data field has the login_data_dst_normalized_user field to display the content in the standardized format. To ensure the most accurate results, we recommend that you use these normalized_user fields when building your queries.