Compare results in table to lookup?

D.Demarest — Tue, 03 Dec 2024 19:33:49 GMT

I have a lookup with software names and want to use it to compare it to results from xdr_data using the fields actor_process_image_path which is the dir the software in installed in.

config case_sensitive = false
| dataset = xdr_data
| filter event_type = PROCESS and event_sub_type = PROCESS_START
| filter actor_process_image_path in (dataset = software| fields Apps)

the issue I have is that I CANNOT for the life of me figure out how to insert a "contain" statement to match, the software list does not have the full install path, just the name of the application, so its not matching even tho I have verified several isntances of apps isntalled on machines that have a match in the list. Example is like the app name is "AdobePDF" and i should be able to have statement that does something like:

actor_process_image_path contains (software), or something like that so it looks thru the software lookup and matches if any of the apps is mentioned in actor_process_image_path .

Thank you!

Re: Compare results in table to lookup?

jmazzeo — Thu, 05 Dec 2024 20:09:47 GMT

Hi @D.Demarest, thanks for reaching us using the Live Community.

Have you tried the Join stage? Could be useful for your use case: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-XQL-Language-Reference/Join

If this post answers your question, please mark it as the solution.

topic Re: Compare results in table to lookup? in Cortex XDR Discussions

Compare results in table to lookup?

Re: Compare results in table to lookup?