topic Re: Inconsistent XQL search results in Cortex XDR Discussions

Inconsistent XQL search results

John_Lodge — Wed, 03 Feb 2021 13:50:00 GMT

When carrying out XQL search...."dataset = xdr_data | fields action_country | dedup action_country"

I receive a set of results with different action_country values as expected.

If I then take one of these values ie Switzerland and run "dataset = xdr_data | fields action_country | filter action_country = SWITZERLAND"

I receive expected results.

If i run the same search with "dataset = xdr_data | fields action_country | filter action_country = IRAN,_ISLAMIC_REPUBLIC_OF " it will not allow me to run the search, as if the search rule is not complete. Surrounding IRAN_,ISLAMIC REPUBLIC OF in quotes allows me to carry out the search however then returns no results despite results being returned in the first search

Re: Inconsistent XQL search results

gjenkins — Tue, 09 Feb 2021 16:34:11 GMT

Hi @John_Lodge ,

It would appear that the value "IRAN_,ISLAMIC REPUBLIC OF," which is a string, is not being parsed properly by XQL. Have you had the opportunity to report this to Support for review?

Re: Inconsistent XQL search results

gjenkins — Thu, 04 Mar 2021 21:00:57 GMT

For anyone looking to know how this was resolved, a bug was registered for this problem which should be resolved in Cortex XDR version 2.8. As a workaround, you can use the two-letter country code to yield the same result. For example:

For "IRAN_,ISLAMIC REPUBLIC OF":

dataset = xdr_data | fields action_country | dedup action_country | filter (action_country = "IR")

Or "VIRGIN_ISLANDS,_BRITISH":
dataset = xdr_data | fields action_country | dedup action_country | filter (action_country = "VG")

A list of two-letter country codes can be found here.