Cortex XQL "Let" replacement

KCaudwell — Wed, 20 Aug 2025 14:37:43 GMT

Hi,

I'm wondering if anybody knows a method, I can use to join multiple queries within the same XQL query.

I have 3 separate queries which return a count of vulnerabilities for each region of logs. How do i merge these 3 queries to return a table which shows

UKI 1

CAN 1

AUS 1

I know this was possible with Sentinel KQL as you could nest queries in let functions.. is it possible with XQL?

Kind regards,

For example:

dataset = va_cves
| arrayexpand affected_hosts
| join (preset = host_inventory_endpoints | filter group_names contains "UKI" | fields endpoint_name, group_names ) as edr edr.endpoint_name = affected_hosts
| fields endpoint_name , group_names , name , description , exploitability_score , impact_score

| comp count(endpoint_name ) as count

dataset = va_cves
| arrayexpand affected_hosts
| join (preset = host_inventory_endpoints | filter group_names contains "CAN" | fields endpoint_name, group_names ) as edr edr.endpoint_name = affected_hosts
| fields endpoint_name , group_names , name , description , exploitability_score , impact_score

| comp count(endpoint_name ) as count

Re: Cortex XQL "Let" replacement

eluis — Fri, 22 Aug 2025 12:21:53 GMT

Hi @KCaudwell

dataset = va_cves | arrayexpand affected_hosts | join (preset = host_inventory_endpoints | filter group_names in ("UKI", "CAN", "AUS") | fields endpoint_name, group_names ) as edr edr.endpoint_name = affected_hosts | fields endpoint_name , group_names , name , description , exploitability_score , impact_score | comp count(endpoint_name ) as count

or maybe

dataset = va_cves | arrayexpand affected_hosts | join (preset = host_inventory_endpoints | filter group_names contains "UKI" OR group_names contains "AUS" OR group_name contains "CAN" | fields endpoint_name, group_names ) as edr edr.endpoint_name = affected_hosts | fields endpoint_name , group_names , name , description , exploitability_score , impact_score | comp count(endpoint_name ) as count

Please let me know if the former worked for you

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis

topic Re: Cortex XQL "Let" replacement in Cortex XDR Discussions

Cortex XQL "Let" replacement

Re: Cortex XQL "Let" replacement