Question about XQL to make a BIOC

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Question about XQL to make a BIOC

L1 Bithead



I'm trying to make a BIOC to inform when a SSH conection is made in some critical assets, but I'm not able to do it in XQL, I have done it using the interface.


Network Connections AND Destination [ Remote port = 22 ] AND Host [ Host Name = <name> ]


The link to the XQL documentation is broken and I'm not able to find how to do it. I prefere to make it in XQL due to I want to make some exclusions and in the interface builder I can only make one exclusion...


Can you please help me?


Best regards


L4 Transporter

Hello @EnriqueSanz ,


Thanks for reaching out on LiveCommunity!

Please take reference from below XQL query to create your BIOC rule. This query simply detect remote port 22 on a particular host. 

dataset = xdr_data
| filter event_type = NETWORK and action_remote_port = 22 and agent_hostname = "<hostname>"


You can add your use case requirements to it.

Below are the links to XQL and BIOC guides.


Please let us know which documentation links are broken so that we can repair them or provide you updated ones.

L1 Bithead


Hi @nsinghvirk,


First of all, thanks for the reply!


The URL that is broken is the first one that I get when I search "xql search" on Google,


On the other hand, I don't get any result when I use the suggested querie using the same asset that the interface search gives me 7 results... I don't know if the problem is in the configuration...

Hello @EnriqueSanz ,


For better search, please bookmark below link for XDR admin guide and in future search within it for your queries.


Regarding the query, please ensure that you are using same time period in your XQL query and in the interface.

L1 Bithead



Yes, I'm using the same period... It's weird...



  • 4 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!