Virtual functions/Variables - Creating anomaly based detection rules - XQL

[AvesterFahimipour]

Hello Everyone,

Cortex XDR has the functionality does allows you to use XQL queries to create lookups or datasets.

The problem is that these are static and cannot be dynamically updated for detection rules.

The use case I had in mind is that I have two XQL queries the first one looks at events occurring from 30 to 1 day ago.

The second query looks for events happening in the current day that have not been seen in the first query which is the last 29 days.

What would be the best way to achieve this goal?

[AvesterFahimipour]

Hello,

Right, so I had an idea:

config timeframe between "30d" and "1d" 
| dataset = xdr_data 
| filter event_type = ENUM.SYSTEM_CALL 
| comp values(actor_process_image_name) as Base 
| join type= inner ( 
config timeframe between "1d" and "now" 
| dataset = xdr_data 
| filter event_type = ENUM.SYSTEM_CALL ) as Rare rare.actor_process_image_name not in(Base)

This should create an array of strings of the original actor processes and look the new data against it and show stuff that in not in the original.

The issue that i am facing for this is that for some reason the in() operator does not take array strings which is super weird.

Do you know how can I match against an array using in?

The query language has so many restrictions 😞