Request for Query to Retrieve Endpoint Security Details.

[Prashanta]

Hi Team,

I would like to create a query that provides the following information for endpoint security events:

• Severity

• Artifact type (e.g., executable files or other relevant artifacts)

• Endpoint name

• IP address

• Windows OS version

• Action taken (e.g., Block or Alert)

• Cortex Agent version
  
  Timeframe:  I will be set manually 
  
  Cortex XDR 

Please let me know the best way to construct this query or if any additional details are required.

[susekar]

Hello @Prashanta ,

Greetings for the day.

To create a query that retrieves security events along with endpoint metadata, you can use the alerts dataset as the primary source. Since details such as the full Windows OS version and Cortex Agent version are most accurately maintained in the endpoints dataset, a left join is recommended to combine these two datasets.

XQL Query

dataset = alerts
| join type = left (dataset = endpoints) as e e.endpoint_name = host_name
| fields
    severity,
    category as artifact_type,
    host_name as endpoint_name,
    host_ip as ip_address,
    e.os_version as windows_os_version,
    action as action_taken,
    e.agent_version as cortex_agent_version

Field Explanations

• Severity: Retrieved directly from the alerts dataset.

• Artifact Type: The category field identifies the type of security issue, such as Malware, Exploit, or Behavioral Threat.

• Action Taken: Displays the outcome of the event, for example ENUM.PREVENTED__BLOCKED_ or Alert.

• Windows OS Version & Agent Version: Retrieved from the endpoints dataset through the join to ensure the most up-to-date inventory information for the endpoint.

How to Use

1. Navigate to Investigation > Query Builder.

2. Switch to the XQL tab.

3. Paste the query into the editor.

4. Set the desired Time Range using the manual selector.

5. Click Run.

Note: If you need to view the specific executable file associated with an alert, you can add action_file_name to the fields list in the query.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar