topic Re: XQL Query Assets XSOAR in Cortex XDR Discussions

XQL Query Assets XSOAR

tlmarques — Wed, 02 Jul 2025 17:36:22 GMT

Hi everyone,
I need your help.
I'm trying to create a CMDB using a playbook in , pulling data from the tab Asset Inventory (XDR-managed devices as well as others collected via mappers and IoT firewalls).

My idea is collect all asset information using XQL, but I haven't been able to identify which dataset contains this information.

Does anyone know if this is possible, or where that asset data might be stored?

Thanks in advance!

Re: XQL Query Assets XSOAR

eluis — Thu, 03 Jul 2025 13:38:02 GMT

Ola Tiago,

There is no dataset for the Asset Inventory page/table.

If you go to cogwheel settings click on configuration and then select Dataset Management option, you can filter the two datasets:

host_inventory

PANW_Network_Mapper_raw

You can pick up the information from those two datasets you can right click on them and see the fields within those two datasets.

I hope this helps

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis

Re: XQL Query Assets XSOAR

tlmarques — Thu, 03 Jul 2025 14:26:15 GMT

Hi @eluis ,

I remembered that — creating an XQL query with three datasets:

[dataset in (endpoints, panw_iot_security_devices_raw, panw_network_mapper_raw)] —

but I was wondering if there might be a single dataset that consolidates the "All Assets" information, hence my question.

What I’m currently trying to figure out is whether, for what I need to do (building a CMDB with this data), I should run the XQL queries separately or combined, in order to reduce duplicate entries, since I’ll need to pull data from endpoints, IoT, and mapper sources.

Once again, thank you for your help.

Re: XQL Query Assets XSOAR

tlmarques — Mon, 07 Jul 2025 16:34:25 GMT

workaround found....i'm doing two querys:

//query iot devices
dataset in (panw_network_mapper_raw, panw_iot_security_devices_raw) |alter mac = lowercase( coalesce(mac, MAC) ), ip = coalesce(ip, ip_address) |fields hostname , mac, ip, vendor,profile, profile_type |filter mac not in (dataset = endpoints | fields mac_address | filter array_length(mac_address) > 0 | arrayexpand mac_address | alter mac_address = lowercase(mac_address)) | dedup MAC by desc _insert_time

//query endpointsXDR
dataset = endpoints
| fields endpoint_name, ip_address, mac_address, endpoint_id
| join type = left (
dataset = host_inventory
| fields host_name, ip_addresses, agent_id, manufacturer, model, serial_number, os_type, os_caption
) as hostinfo (endpoint_id = hostinfo.agent_id)