cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Who rated this post

XQL query with multiple values

L2 Linker

Hello Community,

 

I'm been using the platform for a couple months and recently I'm getting interested in XQL query.

My question is how to I simplify the search string if i have multiple values that I need to insert?
With the example below, i'm looking to simply the filter section to filter action_device_usb_vendor_name "vendor_A, vendor_B, vendor_C". The issue is i'm not sure what is the right delimiter for it.

E.g.

config timeframe = 7d
| dataset = xdr_data
| filter action_device_usb_vendor_name = "vendor_A" or action_device_usb_vendor_name = "vendor_B" or action_device_usb_vendor_name = "vendor_C"
| fields X, Y, Z

 

Thanks in advance.

Cortex XDR 

AC
Who rated this post