topic Need to understand the meanning if cgo cmd in the query builder in General Topics

Need to understand the meanning if cgo cmd in the query builder

Rohita_Tewari — Mon, 11 Mar 2024 11:08:14 GMT

Hi Team,

In the Cortex XDR console, inside the query builder option, we are able to see various options to write query such as Process Name and Acting Process Name, but along with hat weare also able to see an option called ;CGO cmd', what does it mean and what is it used to define while writibg a query?

Regards

Rohita

Re: Need to understand the meanning if cgo cmd in the query builder

kiwi — Tue, 12 Mar 2024 10:16:11 GMT

Hi @Rohita_Tewari ,

CGO CMD: Command-line arguments of the Causality Group Owner.

Source: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Alerts

Also XDR get alerts info:

https://xsoar.pan.dev/docs/reference/integrations/cortex-xdr---ir#xdr-get-alerts

https://xsoar.pan.dev/docs/reference/integrations/cortex-xdr---ir-ctf#xdr-get-alerts-ctf

Kind regards,

-Kim.