Cortex XDR - XQL Query Engine

Cortex XDR - XQL Query Engine enables you to run XQL queries on your data sources.

Endpoint · Cortex XDR by Palo Alto Networks

Configuration parameters

  • url — Server URL (required)
  • apikey_id — (required)
  • apikey — (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (16)

  • xdr-xql-dll-module-query

    Query DLL module events by the SHA256 DLL.

  • xdr-xql-dns-query

    Query by DNS query or domain name.

  • xdr-xql-event-log-query

    Query event logs by event ID.

  • xdr-xql-file-dropper-query

    Search for the process that wrote the given file, by its SHA256 or file path.

  • xdr-xql-file-event-query

    Query file events by the SHA256 file.

  • xdr-xql-generic-query

    Execute an XQL query and retrieve results of an executed XQL query API. The command will be executed every 10 seconds until results are retrieved or until a timeout error is raised. When more than 1000 results are retrieved, the command will return a compressed gzipped JSON format file, unless the argument 'parse_result_file_to_context' is set to true and then the results will be extracted to the context.

  • xdr-xql-get-query-results

    Retrieve results of an executed XQL query API. The command will be executed every 10 seconds until results are retrieved or until a timeout error is raised. When more than 1000 results are retrieved, the command will return a compressed gzipped JSON format file, unless the argument 'parse_result_file_to_context' is set to true and then the results will be extracted to the context.

  • xdr-xql-get-quota

    Retrieve the amount of query quota available and used.

  • xdr-xql-library-create

    Creates or updates XQL query in the library.

  • xdr-xql-library-delete

    Deletes XQL queries from the library.

  • xdr-xql-library-list

    Gets a list of XQL queries from the library.

  • xdr-xql-network-connection-query

    Query network connections between a source IP, destination IP and port.

  • xdr-xql-process-causality-network-activity-query

    Search for network connection created by a given process causality ID.

  • xdr-xql-process-event-query

    Query process events by the SHA256 process.

  • xdr-xql-process-instance-network-activity-query

    Search for network connection created by a given process instance ID.

  • xdr-xql-registry-query

    Query windows registry by registry key name.