Question about XQL to make a BIOC

[EnriqueSanz]

Hello,

I'm trying to make a BIOC to inform when a SSH conection is made in some critical assets, but I'm not able to do it in XQL, I have done it using the interface.

Network Connections AND Destination [ Remote port = 22 ] AND Host [ Host Name = <name> ]

The link to the XQL documentation is broken and I'm not able to find how to do it. I prefere to make it in XQL due to I want to make some exclusions and in the interface builder I can only make one exclusion...

Can you please help me?

Best regards

[nsinghvirk]

Hello @EnriqueSanz ,

Thanks for reaching out on LiveCommunity!

Please take reference from below XQL query to create your BIOC rule. This query simply detect remote port 22 on a particular host. 

dataset = xdr_data
| filter event_type = NETWORK and action_remote_port = 22 and agent_hostname = "<hostname>"

You can add your use case requirements to it.

Below are the links to XQL and BIOC guides.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-XQL-Language-Reference/Get-Started-...

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Working-wit...

Please let us know which documentation links are broken so that we can repair them or provide you updated ones.

[EnriqueSanz]

Hi @nsinghvirk,

First of all, thanks for the reply!

The URL that is broken is the first one that I get when I search "xql search" on Google, https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/...

On the other hand, I don't get any result when I use the suggested querie using the same asset that the interface search gives me 7 results... I don't know if the problem is in the configuration...

[nsinghvirk]

Hello @EnriqueSanz ,

For better search, please bookmark below link for XDR admin guide and in future search within it for your queries.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Overview

Regarding the query, please ensure that you are using same time period in your XQL query and in the interface.

[EnriqueSanz]

Hello!

Yes, I'm using the same period... It's weird...