XQL - Time alteration

AvesterFahimipour — Mon, 24 Feb 2025 08:02:55 GMT

Hello,

Here is the scenario:

I have a table lookup looking for a specific event.

dataset = xdr_data

| filter event_type = SOME EVENT

| alter TimeOfIntereset = _time

Now I want to join this again with the dataset table to enrich it and perform further analysis based on the time.

| join type = inner (

dataset = xdr_data

| filter event_type = SOME EVENT )

At this part when the join happens I only want to look at 30 seconds to 1 minute of events after the time the event of interest occurred.

| filter _time > TimeOfIntereset and _time < TimeOfIntereset + 30s

The issue is that you cannot just add time to a time field.
Personally I believe that XQL is super rigid.

The scenario is essentially a sequence event where I want to look for events occurring up to a minute after a specific event.

so The question is how can I alter the field to be able to add 30 seconds or 1 minute to it and then use it for the filter.

Re: XQL - Time alteration

AvesterFahimipour — Mon, 24 Feb 2025 09:56:33 GMT

Hello Again,
I was able to find the solution:
| alter EndTime = to_timestamp(add(to_epoch(ClipTime , "SECONDS") , 30))
This is how you do it.

topic XQL - Time alteration in Cortex XDR Discussions

XQL - Time alteration

Re: XQL - Time alteration