topic Re: Cortex XSIAM XQL Query Issue in Cortex XSIAM Discussions

Cortex XSIAM XQL Query Issue

Mohitparashar — Wed, 13 Mar 2024 15:27:43 GMT

Hi Team,

I was searching some logs and I found the query I was running initially was just different from the later (2nd) query, however, I was not getting any results for first time but got the results by 2nd query. I moto here just to understand what was the difference using contains or in or "=" for the message or event log fiels while filter out the data. Please find the queries below.

1st Query: (failed to give any results)

config case_sensitive = false timeframe = 2d
| dataset = microsoft_windows_raw
| filter event_id in (4729, 4733, 4735) and message = "*hide for privacy*"

*****************************************************************************************

2nd Query: (Provided the exact event results)

config case_sensitive = false timeframe = 2d
| dataset = microsoft_windows_raw
| filter event_id in (4729, 4733, 4735) and message contains "*hide for privacy*"

Any help or right explaination for this will be appreciated 🙂

@jtalton

Re: Cortex XSIAM XQL Query Issue

afurze — Fri, 15 Mar 2024 14:40:09 GMT

Hi Mohitparashar,

The '=' operator is an exact match operator, it does not accept wildcards as you are trying to use them. Also, since contains is already a substring search, you needn't include the wildcards in your search.

Re: Cortex XSIAM XQL Query Issue

Mohitparashar — Sun, 17 Mar 2024 09:54:34 GMT

Hi @afurze,

Appreciate you reply, could you please confirm the difference between Message "contains" and Message "In". Sometimes using "In" operator give me the exact results I'm looking for but there was situations the operator return 0 value without giving me any error.

Re: Cortex XSIAM XQL Query Issue

jorandall — Mon, 18 Mar 2024 16:35:47 GMT

@Mohitparashar the in operator supports wildcards and can function identically to contains. For example, these two queries are essentially the same:

Link to the docs: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-XQL-Language-Reference/Supported-Operators