topic Re: XQL Query for Endpoint DNS Requests in Cortex XDR Discussions

XQL Query for Endpoint DNS Requests

jruck — Wed, 16 Nov 2022 18:11:01 GMT

Does anyone know a way to search DNS requests from an Endpoint? Seems like it should be possible with XQL Query but I can't find the right fields.

bbarmanroy — Thu, 17 Nov 2022 01:01:37 GMT

Hi @jruck , you'll need to look at the preset 'network_story'.

Here are the first two lines of the query:

preset= network_story | filter (dns_query_name != null) | arrayexpand dns_resolutions

What do you suggest the next few lines to be?

jruck — Thu, 17 Nov 2022 20:16:44 GMT

Perfect thanks, I just changed the dns_query_name to equal the dns query that I was looking for got the logs of the endpoints that made the query.