Cortex XSIAM XQL Query Issue

[Mohitparashar]

Hi Team,

I was searching some logs and I found the query I was running initially was just different from the later (2nd) query, however, I was not getting any results for first time but got the results by 2nd query. I moto here just to understand what was the difference using contains or in or "=" for the message or event log fiels while filter out the data. Please find the queries below.

1st Query: (failed to give any results)

config case_sensitive = false timeframe = 2d
| dataset = microsoft_windows_raw
| filter event_id in (4729, 4733, 4735) and message = "*hide for privacy*"

*****************************************************************************************

2nd Query: (Provided the exact event results)

config case_sensitive = false timeframe = 2d
| dataset = microsoft_windows_raw
| filter event_id in (4729, 4733, 4735) and message contains "*hide for privacy*"

Any help or right explaination for this will be appreciated  🙂

Cortex XSIAM @jtalton  Cortex XDR 

[afurze]

Hi Mohitparashar,

The '=' operator is an exact match operator, it does not accept wildcards as you are trying to use them.  Also, since contains is already a substring search, you needn't include the wildcards in your search.

[Mohitparashar]

Hi @afurze, 

Appreciate you reply, could you please confirm the difference between Message "contains" and Message "In". Sometimes using "In" operator give me the exact results I'm looking for but there was situations the operator return 0 value without giving me any error.

[jorandall]

@Mohitparashar the in operator supports wildcards and can function identically to contains. For example, these two queries are essentially the same:

Link to the docs: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-XQL-Language-Reference/Supporte...