topic Re: XQL Query - Event logs of a particular host in Cortex XDR Discussions

XQL Query - Event logs of a particular host

MithunKT — Wed, 26 Oct 2022 06:43:03 GMT

Hi All,

Can someone tell me how do we query all event logs for a particular hostname using XQL ?

Thanks!!

Re: XQL Query - Event logs of a particular host

neelrohit — Wed, 26 Oct 2022 10:26:53 GMT

*Editing the snippet*

Hi @MithunKT ,

Try using this if you want the xdr logs from the specific endpoints :

dataset = xdr_data
| filter agent_hostname = "<hostname>"

If your requirement is for eventlogs only then you can use the code below:

dataset = xdr_data
| filter agent_hostname = "<hostname>" and event_type = ENUM.EVENT_LOG

Please mark this answer "Accept as Solution" if this answers your question.

Regards

Re: XQL Query - Event logs of a particular host

MithunKT — Wed, 26 Oct 2022 10:36:20 GMT

Hi @neelrohit

I appreciate for giving me the XQL query; it works great. But now I'm having trouble exporting the results (1000000 results). I would like to have these findings in tsv or spreadsheet format, but I cannot do so as it takes a lot of time, and after some time download goes to an error state.

Would you like to suggest a different method for exporting these results into a tsv or excel file?

Thanks!!

Re: XQL Query - Event logs of a particular host

neelrohit — Wed, 26 Oct 2022 10:47:26 GMT

@MithunKT ,

Thanks for reaching out. Cortex XDR can show a maximum of 1000000 results only and it really is more on the microsoft excel download format issue than on the XDR. I would suggest lowering down the timeframe for the query to lower limits(maybe 6 or 12 hours to get the results and export them.)

If you want the query itself to be designated with a custom timeframe then you may add config timeframe syntax to the above.

Example:

config timeframe = 2h//run the query for the last 2 hours of timeframe
|dataset = xdr_data
| filter agent_hostname = "<hostname>" and event_type = ENUM.EVENT_LOG

Hope this solves your problem.

Please mark the answer as "Accepted as Solution" if it solved your query

Regards.