XQL quey help

[agirones]

Hello everyone, 

I would like to replicate some queries in Cortex using XQL, but I have many doubts with this language and I am arguing with it 😄

Example:

T1140 Deobfuscate/Decode Files or Information 

DeviceProcessEvents
| where ProcessVersionInfoProductName == "GNU Privacy Guard (GnuPG)"
| where (ProcessCommandLine has "gpg" and ProcessCommandLine has "--passphrase" or (ProcessCommandLine has "--output" or ProcessCommandLine has "-o") and (ProcessCommandLine has "--decrypt" or ProcessCommandLine has "-d") and (ProcessCommandLine matches regex @"\.gpg" or ProcessCommandLine matches regex @"\.pgp"))

Thanks, regards!

[jmazzeo]

Hi @agirones, thanks for reaching us using the Live Community.

I'll recommend you to take this XQL Crash Course to learn from the basics to some more advanced use cases like the one you are quoting here: https://live.paloaltonetworks.com/t5/cortex-xdr-how-to-videos/cortex-xdr-basic-xql-crash-course/ta-p...

If this post answers your question, please mark it as the solution.