topic Re: HELP - XQL QUERY For XDR and XSOAR in Cortex XDR Discussions

HELP - XQL QUERY For XDR and XSOAR

tlmarques — Fri, 17 May 2024 16:04:26 GMT

Hi,

I am creating a playbook with the objective of integrating Cortex XSOAR and Cortex XDR .

The idea is for Cortex XSOAR to query Cortex XDR , retrieve all the assets detected by the broker scanner, and verify which assets do or do not have the XDR agent.

Does anyone know if this is possible?

My idea is to use both solutions to achieve as much automation as possible.

Another playbook later on will involve XSOAR querying the XDR vulnerability section to identify machines with missing CVEs, listing the machines and CVEs, and then identifying the necessary KBs.

Can anyone help me? Does anyone know if this is possible, even with an XQL query?

Re: HELP - XQL QUERY For XDR and XSOAR

Fm12345 — Fri, 17 May 2024 16:22:59 GMT

Hi @tlmarques

We have data of network mapper scans in network_mapper_raw you can get results of detected hosts there. From there you can probably join endpoints dataset and see which endpoint has xdr agent based on Ip address matching. That much should be possible I think. I need to try to test out the query though.

Not sure about what you mention about cves. But we have va_endpoints with data you need. I.e each entry has endpoint name,cve list that the endpoint is exposed to.

If you want to link it to applications as well then you can use va_cves which has other related info. That's what I can think of. I will try xql and update if I can.

Re: HELP - XQL QUERY For XDR and XSOAR

tlmarques — Fri, 17 May 2024 16:29:55 GMT

Hello @Fm12345 ,

Thanks for the information and help.
Where can I get network_mapper_raw? through XQL query?

If the mapper result tells me that the IP or hostname and if machine have or not XDR agent is perfect.

About CVE's it's the same thing, in the XDR tenant there is a module "Vulnerability Assessment", and my objective is to obtain the CVE's or machines that have update problems and then inject them into XSOAR to create automations.

Re: HELP - XQL QUERY For XDR and XSOAR

Fm12345 — Fri, 17 May 2024 16:38:33 GMT

Yes.. use below query.

dataset = panw_network_mapper_raw

| filter ip not in (dataset = endpoints | arrayexpand ip_address |fields ip_address )

|fields ip,hostname

This will give you hosts that don't have xdr agent. Use filters as per your need.

Re: HELP - XQL QUERY For XDR and XSOAR

tlmarques — Mon, 20 May 2024 10:32:40 GMT

Hi @Fm12345 thanks a lot 😉

do you know what is dataset for module "Vulnerability Assessment"?