Running an XQL Scheduled Report Email If a Result is Found

[michaelsysec242]

Hello, 

I have a working XQL query that deals with Host Connectivity. Can I configure this to run as a scheduled report and only if there are results the report can be sent by email? 

I do not want to receive empty reports. Can this be done in XQL or on the Report side of things?

Many thanks, 

Michael Sysec

Cortex XDR 

[aspatil]

Hello @michaelsysec242 ,

Thanks for reaching us using the Live Community.

That may not be possible. If you already have query ready and want email whenever the result is found, why don't you try correlation rules?
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Create-a-Co...

I understand it may create noise , however this is the only way to get the email. If you want report then it will be sent as per the scheduled time frame, no matters whether result is empty or not.

If this post answers your question, please mark it as the solution.