Problem with Conditional Task Not Matching XQL Output in Cortex XSIAM Playbook

[A.Aliyev094633]

Hello everyone,

I am building a simple playbook in Cortex XSIAM to check whether an endpoint is CONNECTED or DISCONNECTED using an XQL query on the endpoints dataset.

The XQL query works correctly and returns the expected output:

{
"results": [
{
"endpoint_name": "ENDPOINT_089",
"endpoint_status": "DISCONNECTED"
}
],
"status": "SUCCESS"
}

However, in my conditional task I am trying to compare:

endpoint_status == CONNECTED

endpoint_status == DISCONNECTED


Query is  "dataset = endpoints
| filter endpoint_name = "${inputs.EndpointName}"
| fields endpoint_name, endpoint_status"

-

I suspect the issue is that I do not know the correct context object name produced by the script xdr-xql-generic-query. I couldn't find the correct path to reference the output of the xdr-xql-generic-query script inside the Conditional task.

What is the correct output object name for xdr-xql-generic-query in Cortex XSIAM so I can reference results[1].results[0].endpoint_status inside the conditional

task?

Thank you!

[jorandall]

Theres a better and easier way to get this data without burning your Compute Units on XQL queries in playbooks. The Investigation & Response integration from the Cortex Core marketplace pack includes a number of commands and scripts for interacting with your XDR endpoints, specifically the `core-get-endpoints` command, which will return information about your XDR endpoint agents, and the `endpoint` command, which will return information from any endpoint integration you have enabled (XDR, MSFT, CRWD, etc).

[A.Aliyev094633]

Hi, yes you’re right but my issue isn’t about the XQL query itself.
The problem is that I cannot find a stable field/object name in the playbook output.

The task output keeps changing: I couldn't find the correct path to reference the output of the xdr-xql-generic-query script inside the Conditional task. it's not about query. 

That’s what I’m trying to solve.

Thank you for trying to help, I really appreciate it

[jorandall]

Which is why I recommended using either of the commands I noted in my first post. Both create consistent results in context.