XQL Query: Finding Location of Public IP based on iploc command.

[KanwarSingh01]

We are trying to find out ASN number, Organization Name, Location, City, Country for public IPs. Below is our query just in case:

Note: The query which we ran is applied on interface which are receiving public facing IPs. We filtered that part of the query.

config case_sensitive = false 
| dataset = panw_ngfw_threat_raw 
| fields  rule_matched as PA_Rule_Name, severity, direction_of_attack, threat_category, threat_id, threat_name, action, inbound_if as Inbound_Interface, from_zone, source_ip, source_port, outbound_if as Outbound_Interface,to_zone, dest_ip, dest_port, app, tunnel, tunneled_app, log_source_name
| comp Count(threat_name) as Counter by source_ip, dest_ip, dest_port, severity, threat_category, threat_name
| iploc  source_ip loc_city, loc_region, loc_country, loc_continent, loc_latlon, loc_timezone 
| comp Count(loc_city) as Counter by loc_city, loc_continent, loc_country, loc_region 
| sort desc Counter

Now, the challenge we have is that the documentation of iploc command states that it has a column name of LOC_ASN_ORG, LOC_ASN but we are not able to see that: See the error below:

Documentation link: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-XQL-Language-Reference/Iploc

Any suggestions or ideas? Is it a XDR 3.6 console thing? Might be I am not understanding things right...

Thank you.

Cortex XDR 

[bbarmanroy]

Hi @KanwarSingh01 the fields loc_asn and loc_asn_org are missing in line 5 where the iploc stage command is being innvoked. Put it in there and you shall have the information.

See an example:

[KanwarSingh01]

Hi, Just attached the wrong screenshot, in the first reply:

See below

[KanwarSingh01]

Any suggestions guys?