topic XQL query for network events within a subnet in Cortex XDR Discussions

topic XQL query for network events within a subnet in Cortex XDR Discussions https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/xql-query-for-network-events-within-a-subnet/m-p/1205057#M7788 <P>I need an idea for an XQL query to find network events where the remote and local IPs belong to the same subnet. Thanks. </P> Wed, 22 Jan 2025 17:38:58 GMT maximk 2025-01-22T17:38:58Z XQL query for network events within a subnet https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/xql-query-for-network-events-within-a-subnet/m-p/1205057#M7788 <P>I need an idea for an XQL query to find network events where the remote and local IPs belong to the same subnet. Thanks. </P> Wed, 22 Jan 2025 17:38:58 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/xql-query-for-network-events-within-a-subnet/m-p/1205057#M7788 maximk 2025-01-22T17:38:58Z Re: XQL query for network events within a subnet https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/xql-query-for-network-events-within-a-subnet/m-p/1205317#M7796 <P>Hi <a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/669196711">@maximk</a> <BR /><BR />Thanks for writing to LC!</P> <P> </P> <P><SPAN>You can build a network query on this from the action center.<BR /></SPAN></P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="nar_0-1737711834134.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/65433i1E0DEF0B0B22B65E/image-size/medium?v=v2&px=400" role="button" title="nar_0-1737711834134.png" alt="nar_0-1737711834134.png" /></span></P> <P> </P> <P><SPAN>Ref - <A href="https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/XQL-query-entities?tocId=mPOFcB~ZoVzmPIH~82f4MQ" target="_blank">https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/XQL-query-entities?tocId=mPOFcB~ZoVzmPIH~82f4MQ</A><BR /><BR />Give it a like & mark as <STRONG>solution</STRONG> if this helped.<BR /><BR />Best,</SPAN></P> Fri, 24 Jan 2025 09:45:39 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/xql-query-for-network-events-within-a-subnet/m-p/1205317#M7796 nar 2025-01-24T09:45:39Z