Baseline Creation of Endpoints Without Registered Alerts in Cortex XDR

[F.Roa422053]

Good afternoon, it’s a pleasure.

I’m currently working on building a baseline of endpoints that have not generated any alerts within the production timeframe. The idea is to use this baseline as the foundation for a future correlation rule.

I’ve been trying different approaches for hours using XQL queries, but I haven’t been able to get the expected results. Specifically, I need the query to pull data from both datasets (endpoints and alerts) or, alternatively, return a dataset that highlights the endpoints with zero associated alerts in the selected time range.

Has anyone here successfully implemented something similar? If so, could you share how you approached it and how you structured the XQL query to achieve this?

Any guidance or examples would be greatly appreciated.

Thanks in advance!

Cortex XDR 

[eluis · Accepted solution]

Hi @F.Roa422053 

Im not sure what do you exactly mean by baseline in this use case, neither sure what you want to achieve as a correlation baseline. 

Baseline as the meaning of the word is not possible in the way you mention in XDR.

However, reading your question in the later stages, it appears you want to query mutually inclusive data from both, endpoints and alert datasets. 

There is a join function in XQL that you can use to query both datasets independently and join the result into a new custom dataset. 
Please check out the doc: 

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-3.x-Documentation/join

Im gonna give you an example that you can modify as per your needs:

config timeframe = 7d
|dataset = alerts
| fields host_name , host_ip , host_os , agent_os_sub_type , alert_source
| join type = right (dataset = endpoints | filter endpoint_status in (ENUM.CONNECTED , ENUM.DISCONNECTED )| fields endpoint_name , ip_address , operating_system , platform ) as foo foo.endpoint_name = host_name
| comp count(alert_source ) as counter by endpoint_name
| filter counter < 5

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis