Finding if a URL was visited using XQL in Cortex

[KErickson1]

We wanted to see if we could use XQL to query for if a URL was visited in our environment. Is there a way to structure a working query for this using XQL? We've tried unsuccessfully so far, so we are turning to you, the community.

Thank you for any assistance.

[timurphy · Accepted solution]

Hi @KErickson1,

There are a few ways you could go about forming this type of query via XQL. If the forensics add-on is in use, you can query the various forensics_<browser>_history datasets.

Another option could be investigating DNS queries from clients with the XDR agent installed using the network_story preset. Of course, this won't be as detailed as entries in a browser history database (will not be able to determine if a specific URL was visited), but can still be useful in an investigation. Here is a query to help get started with this:

config case_sensitive = false 
| preset = network_story 
| filter (dns_resolutions != null) 
| arrayexpand dns_resolutions 
| alter Resolution_Value = dns_resolutions -> value{}, Resolution_Name = dns_resolutions -> name{}
| fields agent_hostname, actor_process_image_name, actor_process_image_path, actor_process_command_line, Resolution_Name, Resolution_Value, dns_query_type, dns_resolutions
| filter Resolution_Name contains $domain
| sort desc _time 

If you save it to the query library, you can input a particular domain name you are interested in, or simply replace $domain in line 7 with your target domain directly in the query (e.g. "example.com") :

I hope this helps!

Regards,

Tim

[KErickson1]

Thanks Tim for getting back to us so quickly, this worked brilliantly first run!