XQL For Silent Log Source

[rhydhampatel]

below is the query so far but what we are trying to do is get a silent log source detection. For example, one of the log source names has not sent a log in x number of hours then alert. Any suggestions?


dataset = panw_ngfw_traffic_raw | fields log_source_name | dedup log_source_name

[Fm12345]

I need to test but I think it can be something like below.

dataset = panw_ngfw_traffic_raw | fields log_source_name,_timestamp

|comp max(_timestamp) as offlinesince by log_source_name

|Filter  timestamp_diff(currenttime(),offlinesince,"HOUR")> x //x being the hours you mentioned.

Correct the syntaxes wherever necessary using the xql reference.

[rhydhampatel · Accepted solution]

Thank you for that info, that really helped a lot and below is the full query and if you want to limit per log source you can define limit at the end for example | limit 2 etc

dataset = panw_ngfw_traffic_raw

| fields log_source_name, _insert_time, _time

| comp max(_time) as offlinesince by log_source_name

| alter ct = current_time()

| alter diff_in_hour = timestamp_diff(ct, offlinesince, "HOUR")

| filter diff_in_hour > 0