XQL Query / Alert Help

[egolovan]

I'm trying to create a query / correlation rule to notify me if a certain number of connection attempts have hit a certain IP witihn 'x' amount of time. For example,

dataset = panw_ngfw_traffic_raw
| filter (dest_ip contains """xxx.xxx.xxx.xxx""")

Is there a filter to only display if for example there are 500 events?  When I create the correlation rule with this query, there isn't an option to have a threshold. Any ideas?

Thank you.

[jmazzeo · Accepted solution]

Hi @egolovan, thanks for reaching us using the Live Community.

Sadly I don't have PANW Firewall logs in my lab XDR tenant to try to help you, but the way to do this is in the correlation XQL query definition using the count_distinct stage to count this filtered events, and then use the if stage for the >500 validation and return a value to a variable. Then filter this new variable for the >500 connections value and this will generate the correlation event.

I'll try to find a similar use case to share here.

If this post answers your question, please mark it as the solution.

[egolovan · Accepted solution]

Thanks for the information.  I ended up getting a response from the Unit 42 team and they provided a query that worked:

config case_sensitive = false timeframe = 10M
| preset = network_story
| filter action_remote_ip = "XXX.XXX.XXX.XXX"
| comp count(action_local_ip) as counter by action_local_ip
| filter counter >= 300