XSIAM XQL Query help needed

[PA_nts]

Hi All,

So i need some xql query help please..

Example : I have 2 datasets in xsiam, one called 'xdr_data', and another called 'ioc',
In my 'ioc' dataset I have a field called 'indicator' with different values ie 4.4.4.4; 1.2.3.4 for example.. these we auto populate when we find iocs ie ips, hashes, url etc etc..

My plan is to run a correlation rule in realtime that will scan all incoming data in xdr_data and possibly other datasets, and 'match' it to any of these indicator fields.. and if a match is found to generate an alert.

So my question is how would i write the query do to this using multiple datasets and would imagine this would utilize the join statement etc.

note this xsiam tenant does not have a TIM license. else would have been easy 😞

thanks in advance

[PA_nts]

ok so update on this.. 

xql query below seems to work.. needs more work but as a start it will check any values in field 'indicator' on dataset 'IOC' and if a match is found in dataset 'xdr_data' would output, then can use a scheduled correlation rule to look for indicators and generate alerts etc

dataset = xdr_data
| filter dest_ip in (dataset = ioc | fields indicator)
| dedup dest_ip, source_ip
| fields _time, source_ip, dest_ip, app, action

if ever you build on this.. please add in this chat your additions if you can.

appreciated