XQL Query Engine

Query DLL module events by the SHA256 DLL.

Query by DNS query or domain name.

Query event logs by event ID.

Search for the process that wrote the given file, by its SHA256 or file path.

Query file events by the SHA256 file.

Execute an XQL query and retrieve results of an executed XQL query API. The command will be executed every 10 seconds until results are retrieved or until a timeout error is raised. When more than 1000 results are retrieved, the command will return a compressed gzipped JSON format file, unless the argument 'parse_result_file_to_context' is set to true and then the results will be extracted to the context.

Retrieve results of an executed XQL query API. The command will be executed every 10 seconds until results are retrieved or until a timeout error is raised. When more than 1000 results are retrieved, the command will return a compressed gzipped JSON format file, unless the argument 'parse_result_file_to_context' is set to true and then the results will be extracted to the context.

Retrieve the amount of query quota available and used.

Query network connections between a source IP, destination IP and port.

Search for network connection created by a given process causality ID.

Query process events by the SHA256 process.

Search for network connection created by a given process instance ID.

Query windows registry by registry key name.