topic Re: Is There a Way to Escape the asterisk (*) character with Query Builder/XQL Queries in Cortex XDR Discussions

Is There a Way to Escape the asterisk (*) character with Query Builder/XQL Queries

dortasa1 — Mon, 01 May 2023 12:35:40 GMT

Hi,

I'm trying to run the following to run the following query in Query Builder:

The query itself contains the command:

"del *.log /a /s /q /f"

I was wondering if there is a way to escape the asterisk character after the "del. " part of the command in either Query Builder or XQL?

Re: Is There a Way to Escape the asterisk (*) character with Query Builder/XQL Queries

bbarmanroy — Tue, 02 May 2023 04:38:00 GMT

Like this? https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/xql-question-command-line-with-quot-to-xql-query/m-p/505630/highlight/true#M2261

Re: Is There a Way to Escape the asterisk (*) character with Query Builder/XQL Queries

dortasa1 — Tue, 02 May 2023 05:32:03 GMT

Hi Bbarmanory,
In regards to the link you have provided, I did try to put a leading slash with an asterisk (like that '\*') but I didn't get any results.

Re: Is There a Way to Escape the asterisk (*) character with Query Builder/XQL Queries

fmoixsante — Tue, 02 May 2023 07:08:08 GMT

Hi @dortasa1,

Could you please post the XQL query you are trying to execute?

Re: Is There a Way to Escape the asterisk (*) character with Query Builder/XQL Queries

dortasa1 — Tue, 02 May 2023 07:27:52 GMT

Hi Fmoixsante,
Of course,

dataset = xdr_data
|filter os_actor_process_command_line="del *.log /a /s /q /f"

And here is the version with the escaped asterisk character:

dataset = xdr_data
|filter os_actor_process_command_line="del \*.log /a /s /q /f"