Inconsistent XQL search results

[John_Lodge]

When carrying out XQL search...."dataset = xdr_data | fields action_country | dedup action_country"

I receive a set of results with different action_country values as expected.

If I then take one of these values ie Switzerland and run "dataset = xdr_data | fields action_country | filter action_country = SWITZERLAND"

I receive expected results.

If i run the same search with "dataset = xdr_data | fields action_country | filter action_country = IRAN,_ISLAMIC_REPUBLIC_OF " it will not allow me to run the search, as if the search rule is not complete. Surrounding IRAN_,ISLAMIC REPUBLIC OF in quotes allows me to carry out the search however then returns no results despite results being returned in the first search

[gjenkins]

Hi @John_Lodge ,

It would appear that the value "IRAN_,ISLAMIC REPUBLIC OF," which is a string, is not being parsed properly by XQL. Have you had the opportunity to report this to Support for review?

[gjenkins]

For anyone looking to know how this was resolved, a bug was registered for this problem which should be resolved in Cortex XDR version 2.8. As a workaround, you can use the two-letter country code to yield the same result. For example:

For "IRAN_,ISLAMIC REPUBLIC OF":

    dataset = xdr_data | fields action_country | dedup action_country | filter (action_country = "IR")

Or "VIRGIN_ISLANDS,_BRITISH":
    dataset = xdr_data | fields action_country | dedup action_country | filter (action_country = "VG")

A list of two-letter country codes can be found here.