Summarise XQL results by hostname

ianatgrafton — Thu, 14 Dec 2023 17:10:09 GMT

Is it possible to group\count\summarise results from an XQL query by hostname rather than seeing every entry for every event?

for example:

dataset = xdr_data
| filter event_type = FILE and
actor_process_image_name contains "Something"

is there someway I can just summarise or count the number of events per hostname rather than output every event that has the file "something" in it?

Re: Summarise XQL results by hostname

zarnous — Thu, 14 Dec 2023 18:21:23 GMT

Hi @ianatgrafton

You can do that by using the comp stage with its count function (sometimes you will need to use count_distinct based on the use case you are trying to accomplish ) - Reference here - https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-XQL-Language-Reference/count

to your query above, you can write something like the below to count the actor images per hostname, and sort by the count in descending manner :

dataset = xdr_data
| filter event_type = FILE and
actor_process_image_name contains ".exe"
| comp count(actor_process_image_name ) as Image_count by agent_hostname , actor_process_image_name
| sort desc Image_count

Hope that was helpful and shed some light, please feel free to accept this as a solution if it answers your question so others can benefit from.

Best,
Z

topic Re: Summarise XQL results by hostname in Cortex XDR Discussions

Summarise XQL results by hostname

Re: Summarise XQL results by hostname