XSIAM XQL Query help needed

[PA_nts]

Hi All,

So i need some xql query help please..

Example : I have 2 datasets in xsiam, one called 'xdr_data', and another called 'ioc',
In my 'ioc' dataset I have a field called 'indicator' with different values ie 4.4.4.4; 1.2.3.4 for example.. these we auto populate when we find iocs ie ips, hashes, url etc etc..

My plan is to run a correlation rule in realtime that will scan all incoming data in xdr_data and possibly other datasets, and 'match' it to any of these indicator fields.. and if a match is found to generate an alert.

So my question is how would i write the query do to this using multiple datasets and would imagine this would utilize the join statement etc.

note this xsiam tenant does not have a TIM license. else would have been easy 😞

thanks in advance