Summarise XQL results by hostname

[ianatgrafton]

Is it possible to group\count\summarise results from an XQL query by hostname rather than seeing every entry for every event?

for example:

dataset = xdr_data
| filter event_type = FILE and
actor_process_image_name contains "Something" 

is there someway I can just summarise or count the number of events per hostname rather than output every event that has the file "something" in it?

[zarnous · Accepted solution]

Hi @ianatgrafton 

You can do that by using the comp stage with its count function (sometimes you will need to use count_distinct based on the use case you are trying to accomplish ) - Reference here - https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-XQL-Language-Reference/count 

to your query above, you can write something like the below to count the actor images per hostname, and sort by the count in descending manner :

dataset = xdr_data
| filter event_type = FILE and
actor_process_image_name contains ".exe"
| comp count(actor_process_image_name ) as Image_count by agent_hostname , actor_process_image_name
| sort desc Image_count

Hope that was helpful and shed some light, please feel free to accept this as a solution if it answers your question so others can benefit from.

Best,
Z