Cortex XQL "Let" replacement

[KCaudwell]

Hi, 

I'm wondering if anybody knows a method, I can use to join multiple queries within the same XQL query. 

I have 3 separate queries which return a count of vulnerabilities for each region of logs. How do i merge these 3 queries to return a table which shows 

UKI 1 

CAN  1

AUS  1

I know this was possible with Sentinel KQL as you could nest queries in let functions.. is it possible with XQL?

Kind regards, 

For example: 

dataset = va_cves
| arrayexpand affected_hosts
| join (preset = host_inventory_endpoints | filter group_names contains "UKI" | fields endpoint_name, group_names ) as edr edr.endpoint_name = affected_hosts
| fields endpoint_name , group_names , name , description , exploitability_score , impact_score

| comp count(endpoint_name ) as count

dataset = va_cves
| arrayexpand affected_hosts
| join (preset = host_inventory_endpoints | filter group_names contains "CAN" | fields endpoint_name, group_names ) as edr edr.endpoint_name = affected_hosts
| fields endpoint_name , group_names , name , description , exploitability_score , impact_score

| comp count(endpoint_name ) as count

dataset = va_cves
| arrayexpand affected_hosts
| join (preset = host_inventory_endpoints | filter group_names contains "UKI" | fields endpoint_name, group_names ) as edr edr.endpoint_name = affected_hosts
| fields endpoint_name , group_names , name , description , exploitability_score , impact_score

| comp count(endpoint_name ) as count

[eluis]

Hi @KCaudwell 

dataset = va_cves
| arrayexpand affected_hosts
| join (preset = host_inventory_endpoints | filter group_names in ("UKI", "CAN", "AUS") | fields endpoint_name, group_names ) as edr edr.endpoint_name = affected_hosts
| fields endpoint_name , group_names , name , description , exploitability_score , impact_score

| comp count(endpoint_name ) as count

or maybe 

dataset = va_cves
| arrayexpand affected_hosts
| join (preset = host_inventory_endpoints | filter group_names contains "UKI"  OR group_names contains "AUS" OR group_name contains "CAN" | fields endpoint_name, group_names ) as edr edr.endpoint_name = affected_hosts
| fields endpoint_name , group_names , name , description , exploitability_score , impact_score
| comp count(endpoint_name ) as count

Please let me know if the former worked for you

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis