topic Re: Question about XQL to make a BIOC in Cortex XDR Discussions

Question about XQL to make a BIOC

EnriqueSanz — Fri, 13 Oct 2023 09:22:09 GMT

Hello,

I'm trying to make a BIOC to inform when a SSH conection is made in some critical assets, but I'm not able to do it in XQL, I have done it using the interface.

Network Connections AND Destination [ Remote port = 22 ] AND Host [ Host Name = <name> ]

The link to the XQL documentation is broken and I'm not able to find how to do it. I prefere to make it in XQL due to I want to make some exclusions and in the interface builder I can only make one exclusion...

Can you please help me?

Best regards

Re: Question about XQL to make a BIOC

nsinghvirk — Mon, 16 Oct 2023 12:50:24 GMT

Hello @EnriqueSanz ,

Thanks for reaching out on LiveCommunity!

Please take reference from below XQL query to create your BIOC rule. This query simply detect remote port 22 on a particular host.

dataset = xdr_data
| filter event_type = NETWORK and action_remote_port = 22 and agent_hostname = "<hostname>"

You can add your use case requirements to it.

Below are the links to XQL and BIOC guides.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-XQL-Language-Reference/Get-Started-with-XQL

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Working-with-BIOCs

Please let us know which documentation links are broken so that we can repair them or provide you updated ones.

Re: Question about XQL to make a BIOC

EnriqueSanz — Mon, 16 Oct 2023 13:54:09 GMT

Hi @nsinghvirk,

First of all, thanks for the reply!

The URL that is broken is the first one that I get when I search "xql search" on Google, https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/search-queries/query-builder/xql-search

On the other hand, I don't get any result when I use the suggested querie using the same asset that the interface search gives me 7 results... I don't know if the problem is in the configuration...

Re: Question about XQL to make a BIOC

nsinghvirk — Mon, 16 Oct 2023 16:30:15 GMT

Hello @EnriqueSanz ,

For better search, please bookmark below link for XDR admin guide and in future search within it for your queries.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Overview

Regarding the query, please ensure that you are using same time period in your XQL query and in the interface.

Re: Question about XQL to make a BIOC

EnriqueSanz — Tue, 17 Oct 2023 10:56:53 GMT

Hello!

Yes, I'm using the same period... It's weird...