topic Re: XQL Query DNS resolutions in Cortex XDR Discussions

XQL Query DNS resolutions

NathanBradley — Tue, 29 Nov 2022 16:02:25 GMT

I'm attempting to pull out the name, type, and value from the dns_resolutions data

The below query results in "FAILED TO RUN QUERY" with no data, removing the alters does return data however no fields available return "value" in the dns_resolutions

Any help would be appreciated

preset= network_story
| filter (dns_query_name != null)
| arrayexpand dns_resolutions

| alter DNS_Expand_Name=json_extract(dns_resolutions, "$.name")
| alter DNS_Expand_Type=json_extract(dns_resolutions, "$.type")

| alter DNS_Expand_Value=json_extract(dns_resolutions, "$.value")

below is an example of the expanded view of dns_resolutions

{

"name": "www.navistechnologies.com",

"type": "A",

"value": "199.125.15.90"

}

Re: XQL Query DNS resolutions

bbarmanroy — Wed, 30 Nov 2022 06:36:37 GMT

Hi @NathanBradley does it work with any one of the alter statements? You can add one alter statement at a time to determine if something is amiss.
I would also add the following line '| limit 10' and progressively increase the number to determine what is working.

I ran the exact query that you shared and it works just fine.

Re: XQL Query DNS resolutions

NathanBradley — Wed, 30 Nov 2022 15:16:30 GMT

Same results when i add a single alter.

Also,same failed to run result if i change to dataset=xdr_data