topic XQL For Silent Log Source in Cortex XDR Discussions

XQL For Silent Log Source

rhydhampatel — Tue, 15 Oct 2024 15:49:18 GMT

below is the query so far but what we are trying to do is get a silent log source detection. For example, one of the log source names has not sent a log in x number of hours then alert. Any suggestions?

dataset = panw_ngfw_traffic_raw | fields log_source_name | dedup log_source_name

Re: XQL For Silent Log Source

Fm12345 — Thu, 17 Oct 2024 04:53:20 GMT

I need to test but I think it can be something like below.

dataset = panw_ngfw_traffic_raw | fields log_source_name,_timestamp

|comp max(_timestamp) as offlinesince by log_source_name

|Filter timestamp_diff(currenttime(),offlinesince,"HOUR")> x //x being the hours you mentioned.

Correct the syntaxes wherever necessary using the xql reference.

Re: XQL For Silent Log Source

rhydhampatel — Thu, 17 Oct 2024 17:38:12 GMT

Thank you for that info, that really helped a lot and below is the full query and if you want to limit per log source you can define limit at the end for example | limit 2 etc

dataset = panw_ngfw_traffic_raw

| fields log_source_name, _insert_time, _time

| comp max(_time) as offlinesince by log_source_name

| alter ct = current_time()

| alter diff_in_hour = timestamp_diff(ct, offlinesince, "HOUR")

| filter diff_in_hour > 0