XQL - Hostfirewall events

[J.Gammara]

Hi everyone,

What is the best and most efficient way to review network traffic and correlate or compare it with Host Firewall events using XQL?

I am looking for the optimal approach to query and analyze this data together without impacting performance. If anyone has a sample XQL query or advice on how you handle this in your SOC, I would really appreciate it.

Thanks in advance!

[susekar]

Hello @J.Gammara ,

Greetings for the day.

To review and correlate network traffic with Host Firewall events efficiently in Cortex XDR, you should utilize a combination of dedicated datasets and optimized XQL join stages.

The optimal approach involves querying the host_firewall_events dataset for firewall-specific enforcement and joining it with normalized network presets to gain process and connectivity context.

1. Identify the Correct Datasets:

• Host Firewall Events: Enforcement actions (Allow/Block) taken by the agent's firewall module are stored in the dedicated host_firewall_events dataset.
• Network Traffic: General network activity is best reviewed using the network_story (Network Connections) preset, which contains stitched logs combining events from various sources. Alternatively, raw agent network events reside in the xdr_data dataset.

Sample XQL Correlation Query:

The following query correlates blocked Host Firewall events with network connectivity data to identify which processes were involved in the blocked traffic:

dataset = host_firewall_events 
| filter action = 2 // Filter for Blocked events
| fields _time, agent_hostname, action_local_ip, action_remote_ip, action_remote_port, action_process_image_path, actor_process_instance_id, agent_id
| join (
    preset = network_story 
    | fields agent_hostname, actor_process_instance_id, action_app_id_transitions, action_external_hostname
) as net network.agent_hostname = agent_hostname and network.actor_process_instance_id = actor_process_instance_id
| fields _time, agent_hostname, action_process_image_path, action_local_ip, action_remote_ip, action_remote_port, net.action_app_id_transitions, net.action_external_hostname

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar