topic XQL Query in Cortex XDR Discussions

XQL Query

RamyashreeMada — Tue, 12 Sep 2023 10:58:10 GMT

Hello,

Need XQL query where the particular endpoint comes online need to notify us.

Re: XQL Query

DishantDeep — Wed, 13 Sep 2023 02:40:12 GMT

Hi RamyashreeMada,

Try this one:

config case_sensitive = false
|dataset = endpoints
| filter endpoint_type = ENUM.TYPE_WORKSTATION and endpoint_status = ENUM.CONNECTED
| filter endpoint_name = "HostName"
| fields endpoint_name, endpoint_status as Status

Re: XQL Query

DishantDeep — Wed, 13 Sep 2023 02:43:15 GMT

You need to create a correlation rule in order to generate the alert.