Cortex XQL help

[elnur.abbasov]

Hello Dear Community, I want to count events based on specified time periods. For example I want to query hosts that scanned more than 50 hosts in 10 seconds. How can I write XQL in that case?  

Cortex XDR 

[aspatil]

Hello @elnur.abbasov ,

Could you please confirm what kindly of events are you looking for and what type of scanning you have mentioned.

Regards,

Ashutosh

[Antony_Chan]

Hello @elnur.abbasov ,

Not a direct answer to your question, but you may start with the one that I'm using:

dataset = xdr_data
//Event_type = 2 is referred to "NETWORK"
//Search for remote host that scan for specific ports
| filter event_type = 2 and action_network_is_server = True and action_remote_ip not in (null, "::1", "127.0.0.1") and causality_actor_process_image_path = "System" 
| comp count_distinct(action_local_ip) as connection_count, values(action_local_ip) as destination by action_remote_ip,action_local_port
| filter connection_count > 100

//Joining XDR endpoint dataset to validate the present of Cortex XDR agent on Remote IP
| join type=left conflict_strategy = right  (
    dataset=endpoints 
    | filter ip_address != null 
    | fields ip_address, endpoint_name
    | arrayexpand ip_address) as ep ep.ip_address = action_remote_ip
| filter endpoint_name = null
//Correlate hostname based on ip address. This information are obtained from NGFW. (Fairly reliable, but not 100% accurate - especially workstation's ip will change due to DHCP.)
| join type= left conflict_strategy = right (
    preset = network_story 
    | filter action_external_hostname != null
    | dedup action_local_ip
    | fields action_external_hostname as DNS_name, action_local_ip) as FWdata fwdata.action_local_ip = action_remote_ip 
| fields action_remote_ip as remote_ip, DNS_name, destination, connection_count, action_local_port as destination_port
| sort desc connection_count

Let me know if you have any questions.