XQL "call" functions from scripts library

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

XQL "call" functions from scripts library

L1 Bithead

Hi Peeps,

 

So XQL has this call function to fetch results from a saved query in the query library. Lets take this for example:

 

call "All appdata executions for the past 30 days"

 

Now, the problem is that my saved query is waiting for a parameter "$hostname". Anyone have any ideas how to pass that parameter through XQL?

 

Or probably point me to a KB of some sorts.

 

Thanks a lot,

Jill

Jill
1 ACCEPTED SOLUTION

Accepted Solutions

L5 Sessionator

This works for me:
call "Host Inventory Autorun" Hostname="Bisma"

bbarmanroy_0-1659406766161.png

 

View solution in original post

5 REPLIES 5

L1 Bithead

Sorry
XQL "call" functions from query library I mean

Jill

Hi @JillianSagun 

Go to Query library, and paste the XQL query in the thread here for us to replicate and advise accordingly. I believe this might not be created by Palo Alto Networks.

bbarmanroy_0-1659332020885.png

 

Hi Bbamanroy,


Yeah.. this one I created myself. Take this for example

=====

config case_sensitive = false timeframe = 7d
| preset = host_inventory_auto_runs
| filter endpoint_name = $Hostname and cmd in ("*appdata*","c:\users*")
=====
I'm taking $Hostname as a parameter for the query.

 

I have multiple saved queries in the library that requires a hostname to be passed and I wanted to be able to call them and probably use join/union to merge the results.

 

Sure I can use both join/union in the query but I want to make them flexible like:

I will use w, x, y, and z queries for a certain event 

w, x, and y for another

and so on..

 

Appreciate the response!

 

Jill

L5 Sessionator

This works for me:
call "Host Inventory Autorun" Hostname="Bisma"

bbarmanroy_0-1659406766161.png

 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!