Query Builder to XQL

cancel
Showing results for 
Search instead for 
Did you mean: 

Query Builder to XQL

L1 Bithead

I have built queries within builder that I cannot replicate in a xql query

Is there a way to convert them quickly?

The example below was built with the builder, a search for files within removable media for the previous 24 hours

I need it in xql syntax in order to create widgets...etc

 

 

File [ action type = all AND device type = removable media ] AND Time [ event timestamp in last 24H before Sep 24th 2021 01:00:00 ]

3 REPLIES 3

L1 Bithead

Hi Nathan,

I haven't seen a way to convert queries from query builder to XQL as a feature in the product right now.

 

But from XQL query library you can use the one named:

Users creating more than 100 files on a removable device
 
It should give you a good starting point for what you're trying to do.
 
Good luck.
 
Luc

L1 Bithead

dataset = xdr_data
| fields action_file_device_info as drive_info
| alter device_type = json_extract(to_json_string(drive_info), "$.storage_device_drive_type")
| filter drive_info != null
| filter device_type = "2"


==========================
Note: Device type could be
==========================
Unknown = 0,
Fixed = 1,
Removable = 2,
Cdrom = 3,
Network = 4,
Ramdisk = 5
The "storage_device_drive_type" field is taken from this enum (json):

L1 Bithead

Thanks I ended up with the following as i needed to include the user, file path, and file name

Now i just need the report to print all data in the PDF rather than a subset

 

dataset = xdr_data
| filter event_type = FILE and event_sub_type = FILE_CREATE_NEW
| alter Drive_Type = json_extract(to_json_string(action_file_device_info),"$.storage_device_drive_type")
| filter drive_type = "2"
| fields action_file_path as File_Path, actor_effective_username as Username, action_file_name

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!