topic XQL removes endpoint CVEs and ALL information in Cortex XDR Discussions

XQL removes endpoint CVEs and ALL information

HCSammyChou — Fri, 07 Mar 2025 00:05:55 GMT

I want to remove all information related to the endpoint "ABC". However, with the following xql query, it only removes cves that are exclusively associated with this endpoint. If a cves is associated with multiple endpoints, the affected_products, affected_hosts, and affected_hosts_count fields still display information related to "ABC".

How should I modify the query so that no information about"ABC" appears in the cves, even if the cves affects multiple endpoints?

MY xql QUERY:

dataset = va_cves
| filter affected_hosts != "ABC"
| filter severity >=low
| filter affected_hosts_count >=1
| fields name as CVE, severity , severity_score ,type as APPLICATION_OPERATINGSYSTEM,description ,affected_products, affected_hosts ,affected_hosts_count,publication_date
|sort desc publication_date

Re: XQL removes endpoint CVEs and ALL information

aspatil — Mon, 17 Mar 2025 14:25:39 GMT

Hello @HCSammyChou ,

Below query should help!

dataset = va_cves
|arrayexpand affected_hosts
|filter affected_hosts != "abc"
| filter severity >=low
| filter affected_hosts_count >=1
| fields name as CVE, severity , severity_score ,type as APPLICATION_OPERATINGSYSTEM,description ,affected_products, affected_hosts ,affected_hosts_count,publication_date
|sort desc publication_date

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

Re: XQL removes endpoint CVEs and ALL information

HCSammyChou — Mon, 24 Mar 2025 12:10:50 GMT

This is not the answer I am looking for. In this way, the affected products of the endpoint "abc" will still be displayed in affected_products

Re: XQL removes endpoint CVEs and ALL information

aspatil — Tue, 25 Mar 2025 06:28:03 GMT

Cannot understand your requirement. Your ask was I want to remove all information related to the endpoint "ABC". I have provided you the sample query which excludes the host. The affected product can be applied to multiple hosts, hence it will be displayed. To understand more please open CS case.