topic Re: XSOAR XDR Query Context Data Delay in Cortex XSOAR Discussions

XSOAR XDR Query Context Data Delay

Honza_Linhart — Mon, 09 Jan 2023 11:55:09 GMT

Hi everybody,

could you please help me with following issue?

When I use XQL query to XDR dataset (!xdr-xql-generic-query) it returns correct data to the War room but before are this data moved to Context data it takes almost 5 minutes (No matter how many data has been returned from XDR. This interval is always the same).

It looks like some kind of timeout but I tried to change everything possible and it didn't change the behavior.

I need to have it in context data in near-realtime.

Thank you,

Jan

Re: XSOAR XDR Query Context Data Delay

yuki_sato — Tue, 10 Jan 2023 23:55:15 GMT

Hi @Honza_Linhart

Complexity of XQL query and time range for the search could affect the time it would take to process and to display the result.

We might able to better help if you can provide what query you are trying to run and arguments you execute upon running the command in XSOAR. A video of executing the command might be helpful also.

You could also open a support ticket if you want us to look into it privately if query/video might contain sensitive information.

https://support.paloaltonetworks.com/Support/Index

Re: XSOAR XDR Query Context Data Delay

Honza_Linhart — Thu, 12 Jan 2023 12:53:02 GMT

Hi @yuki_sato,

thank you for the response. In this case, there was not a problem with return of query result, it didn't take long. What took long was transition of returned data into incident context data. Today we found that this behavior is related to only one account in MSSP deployment. I will try to find a root cause, but probably will have to open support ticket.