XQL Query Help

[Y.Kiroglu]

I'm trying to write a few XQL queries in Cortex XDR, but I’m quite new to it and running into some difficulties. I’d really appreciate any guidance or examples you can provide for any of the following queries:

1. To detect when the Cortex XDR Agent is uninstalled,
2. To trigger an alert for Tamper Detection,
3. To monitor if a live terminal session is initiated on any machine,
4. To identify Domain Admin logon events occurring between 19:30 and 07:30 (I believe Event ID 4672 can be used here).

Thank you very much for your help 🙂