XQL Query: Finding Location of Public IP based on iploc command.

KanwarSingh01 — Tue, 07 Mar 2023 00:38:30 GMT

We are trying to find out ASN number, Organization Name, Location, City, Country for public IPs. Below is our query just in case:

Note: The query which we ran is applied on interface which are receiving public facing IPs. We filtered that part of the query.

config case_sensitive = false | dataset = panw_ngfw_threat_raw | fields rule_matched as PA_Rule_Name, severity, direction_of_attack, threat_category, threat_id, threat_name, action, inbound_if as Inbound_Interface, from_zone, source_ip, source_port, outbound_if as Outbound_Interface,to_zone, dest_ip, dest_port, app, tunnel, tunneled_app, log_source_name | comp Count(threat_name) as Counter by source_ip, dest_ip, dest_port, severity, threat_category, threat_name | iploc source_ip loc_city, loc_region, loc_country, loc_continent, loc_latlon, loc_timezone | comp Count(loc_city) as Counter by loc_city, loc_continent, loc_country, loc_region | sort desc Counter

Now, the challenge we have is that the documentation of iploc command states that it has a column name of LOC_ASN_ORG, LOC_ASN but we are not able to see that: See the error below:

Documentation link: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-XQL-Language-Reference/Iploc

Any suggestions or ideas? Is it a XDR 3.6 console thing? Might be I am not understanding things right...

Thank you.

Re: XQL Query: Finding Location of Public IP based on iploc command.

bbarmanroy — Tue, 07 Mar 2023 02:09:28 GMT

Hi @KanwarSingh01 the fields loc_asn and loc_asn_org are missing in line 5 where the iploc stage command is being innvoked. Put it in there and you shall have the information.

See an example:

Re: XQL Query: Finding Location of Public IP based on iploc command.

KanwarSingh01 — Tue, 07 Mar 2023 02:15:13 GMT

Hi, Just attached the wrong screenshot, in the first reply:

See below

Re: XQL Query: Finding Location of Public IP based on iploc command.

KanwarSingh01 — Mon, 13 Mar 2023 23:17:31 GMT

Any suggestions guys?

topic Re: XQL Query: Finding Location of Public IP based on iploc command. in Cortex XDR Discussions

XQL Query: Finding Location of Public IP based on iploc command.

Re: XQL Query: Finding Location of Public IP based on iploc command.

Re: XQL Query: Finding Location of Public IP based on iploc command.

Re: XQL Query: Finding Location of Public IP based on iploc command.