XQL quey help

agirones — Tue, 30 Apr 2024 09:13:31 GMT

Hello everyone,

I would like to replicate some queries in Cortex using XQL, but I have many doubts with this language and I am arguing with it 😄

Example:

T1140 Deobfuscate/Decode Files or Information

DeviceProcessEvents | where ProcessVersionInfoProductName == "GNU Privacy Guard (GnuPG)" | where (ProcessCommandLine has "gpg" and ProcessCommandLine has "--passphrase" or (ProcessCommandLine has "--output" or ProcessCommandLine has "-o") and (ProcessCommandLine has "--decrypt" or ProcessCommandLine has "-d") and (ProcessCommandLine matches regex @"\.gpg" or ProcessCommandLine matches regex @"\.pgp"))

Thanks, regards!

Re: XQL quey help

jmazzeo — Thu, 02 May 2024 15:57:34 GMT

Hi @agirones, thanks for reaching us using the Live Community.

I'll recommend you to take this XQL Crash Course to learn from the basics to some more advanced use cases like the one you are quoting here: https://live.paloaltonetworks.com/t5/cortex-xdr-how-to-videos/cortex-xdr-basic-xql-crash-course/ta-p/544056

If this post answers your question, please mark it as the solution.

topic Re: XQL quey help in Cortex XDR Discussions

XQL quey help

Re: XQL quey help