XQL: Anyone has working example of building analytics on XQL query?

[KanwarSingh01]

We want to build analytics using XQL where we could find or create an alert if certain behavior has occurred for the first time on endpoint.

Currently, we use external help where we run XQL schedule query and then retrieve results and run python script based on our use case.

Any suggestion will be helpful.

[nsinghvirk]

Hello @KanwarSingh01 

Thanks for reaching out on LiveCommunity!

You can use correlation rules which will help you analyse correlations of multi-events from multiple sources by using the Cortex Query Language (XQL) based engine for creating scheduled rules. Alerts can then be triggered based on these correlation rules with a defined time frame and set schedule, including every X minutes, once a day, once a week, or a custom time.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/Create-a-correlation-...

Then you can create automation rules to respond with endpoint scripts as per your use case.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/Automation-rule-actio...

Please click Accept as Solution to acknowledge that the answer to your question has been provided.