topic Re: Problem with Conditional Task Not Matching XQL Output in Cortex XSIAM Playbook in Cortex XSIAM Discussions

Problem with Conditional Task Not Matching XQL Output in Cortex XSIAM Playbook

A.Aliyev094633 — Sun, 23 Nov 2025 16:46:43 GMT

Hello everyone,

I am building a simple playbook in Cortex XSIAM to check whether an endpoint is CONNECTED or DISCONNECTED using an XQL query on the endpoints dataset.

The XQL query works correctly and returns the expected output:

{
"results": [
{
"endpoint_name": "ENDPOINT_089",
"endpoint_status": "DISCONNECTED"
}
],
"status": "SUCCESS"
}

However, in my conditional task I am trying to compare:

endpoint_status == CONNECTED

endpoint_status == DISCONNECTED

Query is "dataset = endpoints
| filter endpoint_name = "${inputs.EndpointName}"
| fields endpoint_name, endpoint_status"

I suspect the issue is that I do not know the correct context object name produced by the script xdr-xql-generic-query. I couldn't find the correct path to reference the output of the xdr-xql-generic-query script inside the Conditional task.

What is the correct output object name for xdr-xql-generic-query in Cortex XSIAM so I can reference results[1].results[0].endpoint_status inside the conditional

task?

Thank you!

Re: Problem with Conditional Task Not Matching XQL Output in Cortex XSIAM Playbook

jorandall — Mon, 24 Nov 2025 17:13:58 GMT

Theres a better and easier way to get this data without burning your Compute Units on XQL queries in playbooks. The Investigation & Response integration from the Cortex Core marketplace pack includes a number of commands and scripts for interacting with your XDR endpoints, specifically the `core-get-endpoints` command, which will return information about your XDR endpoint agents, and the `endpoint` command, which will return information from any endpoint integration you have enabled (XDR, MSFT, CRWD, etc).

Re: Problem with Conditional Task Not Matching XQL Output in Cortex XSIAM Playbook

A.Aliyev094633 — Fri, 05 Dec 2025 07:03:22 GMT

Hi, yes you’re right but my issue isn’t about the XQL query itself.
The problem is that I cannot find a stable field/object name in the playbook output.

The task output keeps changing: I couldn't find the correct path to reference the output of the xdr-xql-generic-query script inside the Conditional task. it's not about query.

That’s what I’m trying to solve.

Thank you for trying to help, I really appreciate it

Re: Problem with Conditional Task Not Matching XQL Output in Cortex XSIAM Playbook

jorandall — Sat, 06 Dec 2025 19:09:17 GMT

Which is why I recommended using either of the commands I noted in my first post. Both create consistent results in context.

Re: Problem with Conditional Task Not Matching XQL Output in Cortex XSIAM Playbook

MDovirak — Wed, 07 Jan 2026 11:27:01 GMT

If you would like to catch the output from XQL in the script and compare in the conditional task, you should have a similar input:

${PaloAltoNetworksXQL.GenericQuery.results.[0].YOUR_VALUE}

In my case, we compare the parameter first_seen, and depends on the XQL results, we have auto-resolve or additional escalation.