topic Re: XQL "call" functions from scripts library in Cortex XDR Discussions

XQL "call" functions from scripts library

JillianSagun — Fri, 29 Jul 2022 23:25:37 GMT

Hi Peeps,

So XQL has this call function to fetch results from a saved query in the query library. Lets take this for example:

call "All appdata executions for the past 30 days"

Now, the problem is that my saved query is waiting for a parameter "$hostname". Anyone have any ideas how to pass that parameter through XQL?

Or probably point me to a KB of some sorts.

Thanks a lot,

Jill

Re: XQL "call" functions from scripts library

JillianSagun — Fri, 29 Jul 2022 23:26:54 GMT

Sorry
XQL "call" functions from query library I mean

Re: XQL "call" functions from scripts library

bbarmanroy — Mon, 01 Aug 2022 05:33:46 GMT

Hi @JillianSagun

Go to Query library, and paste the XQL query in the thread here for us to replicate and advise accordingly. I believe this might not be created by Palo Alto Networks.

Re: XQL "call" functions from scripts library

JillianSagun — Mon, 01 Aug 2022 18:43:02 GMT

Hi Bbamanroy,

Yeah.. this one I created myself. Take this for example

=====

config case_sensitive = false timeframe = 7d
| preset = host_inventory_auto_runs
| filter endpoint_name = $Hostname and cmd in ("*appdata*","c:\users*")
=====
I'm taking $Hostname as a parameter for the query.

I have multiple saved queries in the library that requires a hostname to be passed and I wanted to be able to call them and probably use join/union to merge the results.

Sure I can use both join/union in the query but I want to make them flexible like:

I will use w, x, y, and z queries for a certain event

w, x, and y for another

and so on..

Appreciate the response!

Re: XQL "call" functions from scripts library

bbarmanroy — Tue, 02 Aug 2022 02:19:43 GMT

This works for me:
call "Host Inventory Autorun" Hostname="Bisma"

Re: XQL "call" functions from scripts library

JillianSagun — Tue, 02 Aug 2022 14:02:15 GMT

Weird.. I tried something similar but anyways thank you!

Works for me too.