Who Me Too'd this topic

Hi,

I am creating a custom query where I will need to re-use certain fields.

Ex.: I want to search for:

-action_local_ip and action_remote_ip

-action_file_sha256 and action_module_sha256

-dst_agent_hostname, dst_action_external_hostname and http_server

I think I already saw a way to do this using a user-defined variable, but I cannot find the information on how to do this.

Something like:

dataset = xdr_data

$QueryIP="192.168.1.1"

|filter action_local_ip = $QueryIP or action_remote_ip = $QueryIP

Can someone help? Is that even possible?

Also, taking this question to the next level: Can my variable be an array?!

$QueryIP="192.168.1.1", "192.168.1.2", "192.168.1.3"

|filter action_local_ip in ($QueryIP) or action_remote_ip in ($QueryIP)

Thanks,

Alex.

Cortex XDR