topic Re: XQL query with multiple values in Cortex XDR Discussions

XQL query with multiple values

Antony_Chan — Thu, 04 Aug 2022 08:40:11 GMT

Hello Community,

I'm been using the platform for a couple months and recently I'm getting interested in XQL query.

My question is how to I simplify the search string if i have multiple values that I need to insert?
With the example below, i'm looking to simply the filter section to filter action_device_usb_vendor_name "vendor_A, vendor_B, vendor_C". The issue is i'm not sure what is the right delimiter for it.

E.g.

config timeframe = 7d
| dataset = xdr_data
| filter action_device_usb_vendor_name = "vendor_A" or action_device_usb_vendor_name = "vendor_B" or action_device_usb_vendor_name = "vendor_C"
| fields X, Y, Z

Thanks in advance.

Re: XQL query with multiple values

tyler_bailey — Thu, 04 Aug 2022 12:40:33 GMT

I think what you are looking for it the "in" operator.

config timeframe = 7d
| dataset = xdr_data
| filter action_device_usb_vendor_name in ("vendor_A", "vendor_B", "vendor_C")
| fields X, Y, Z

Re: XQL query with multiple values

Antony_Chan — Thu, 04 Aug 2022 12:55:57 GMT

OMG, this is it! The query is tidy and clean now. Thank you!