topic XQL query between 2 dates in Cortex XDR Discussions

XQL query between 2 dates

FabioFerreira — Fri, 12 May 2023 11:22:07 GMT

Hi,

I want to query a specific number of events between 2 dates.

I have this query below, but it is missing the "between current_date and last 5 minutes"

Could you help pls

Regards,

Re: XQL query between 2 dates

afurze — Fri, 12 May 2023 14:00:09 GMT

FabioFerreira,

You can use the config stage command to specify a timeframe like so...

Re: XQL query between 2 dates

kadirerol — Fri, 16 Feb 2024 10:40:08 GMT

Hi everyone,

I need your help. I wanna create new rule about FW action. Actually my new rules purpose is If there are a lot of FW action drop and next FW allow in 5 minutes. But I dont know how can i create this. In the below just L2L drop logs .

|dataset = panw_ngfw_traffic_raw
|filter source_ip incidr "172.16.0.0/12" or source_ip incidr "192.168.0.0/16" or source_ip incidr "10.0.0.0/8"
|filter dest_ip incidr "172.16.0.0/12" or dest_ip incidr "192.168.0.0/16" or dest_ip incidr "10.0.0.0/8"
|comp count(action ) as action_count by source_ip,action,dest_ip
|dedup source_ip
|filter action_count > 1000 and action ="drop"