XQL Query Engine

XQL Query Engine enables you to run XQL queries on your data sources.

Category

Endpoint

Pack

Core

Configuration parameters

• url — Server URL
• apikey_id — API Key ID
• apikey — API Key

Commands (13)

• xdr-xql-dll-module-query — Query DLL module events by the SHA256 DLL.
• xdr-xql-dns-query — Query by DNS query or domain name.
• xdr-xql-event-log-query — Query event logs by event ID.
• xdr-xql-file-dropper-query — Search for the process that wrote the given file, by its SHA256 or file path.
• xdr-xql-file-event-query — Query file events by the SHA256 file.
• xdr-xql-generic-query — Execute an XQL query and retrieve results of an executed XQL query API. The command will be executed every 10 seconds until results are retrieved or until a timeout error is raised. When more than 1000 results are retrieved, the command will return a compressed gzipped JSON format file, unless the argument 'parse_result_file_to_context' is set to true and then the results will be extracted to the context.
• xdr-xql-get-query-results — Retrieve results of an executed XQL query API. The command will be executed every 10 seconds until results are retrieved or until a timeout error is raised. When more than 1000 results are retrieved, the command will return a compressed gzipped JSON format file, unless the argument 'parse_result_file_to_context' is set to true and then the results will be extracted to the context.
• xdr-xql-get-quota — Retrieve the amount of query quota available and used.
• xdr-xql-network-connection-query — Query network connections between a source IP, destination IP and port.
• xdr-xql-process-causality-network-activity-query — Search for network connection created by a given process causality ID.
• xdr-xql-process-event-query — Query process events by the SHA256 process.
• xdr-xql-process-instance-network-activity-query — Search for network connection created by a given process instance ID.
• xdr-xql-registry-query — Query windows registry by registry key name.