Running an XQL Scheduled Report Email If a Result is Found

michaelsysec242 — Tue, 16 Jul 2024 12:55:39 GMT

Hello,

I have a working XQL query that deals with Host Connectivity. Can I configure this to run as a scheduled report and only if there are results the report can be sent by email?

I do not want to receive empty reports. Can this be done in XQL or on the Report side of things?

Many thanks,

Michael Sysec

Re: Running an XQL Scheduled Report Email If a Result is Found

aspatil — Tue, 16 Jul 2024 16:09:57 GMT

Hello @michaelsysec242 ,

Thanks for reaching us using the Live Community.

That may not be possible. If you already have query ready and want email whenever the result is found, why don't you try correlation rules?
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Create-a-Correlation-Rule

I understand it may create noise , however this is the only way to get the email. If you want report then it will be sent as per the scheduled time frame, no matters whether result is empty or not.

If this post answers your question, please mark it as the solution.

topic Re: Running an XQL Scheduled Report Email If a Result is Found in Cortex XDR Discussions

Running an XQL Scheduled Report Email If a Result is Found

Re: Running an XQL Scheduled Report Email If a Result is Found