Cortex XDR - XQL Query Engine
Cortex XDR - XQL Query Engine enables you to run XQL queries on your data sources.
- Category
- Endpoint
- Pack
- CortexXDR
Configuration parameters
- url — Server URL (required)
- apikey_id — (required)
- apikey — (required)
- insecure — Trust any certificate (not secure)
- proxy — Use system proxy settings
Commands (16)
- xdr-xql-dll-module-query — Query DLL module events by the SHA256 DLL.
- xdr-xql-dns-query — Query by DNS query or domain name.
- xdr-xql-event-log-query — Query event logs by event ID.
- xdr-xql-file-dropper-query — Search for the process that wrote the given file, by its SHA256 or file path.
- xdr-xql-file-event-query — Query file events by the SHA256 file.
- xdr-xql-generic-query — Execute an XQL query and retrieve results of an executed XQL query API. The command will be executed every 10 seconds until results are retrieved or until a timeout error is raised. When more than 1000 results are retrieved, the command will return a compressed gzipped JSON format file, unless the argument 'parse_result_file_to_context' is set to true and then the results will be extracted to the context.
- xdr-xql-get-query-results — Retrieve results of an executed XQL query API. The command will be executed every 10 seconds until results are retrieved or until a timeout error is raised. When more than 1000 results are retrieved, the command will return a compressed gzipped JSON format file, unless the argument 'parse_result_file_to_context' is set to true and then the results will be extracted to the context.
- xdr-xql-get-quota — Retrieve the amount of query quota available and used.
- xdr-xql-library-create — Creates or updates XQL query in the library.
- xdr-xql-library-delete — Deletes XQL queries from the library.
- xdr-xql-library-list — Gets a list of XQL queries from the library.
- xdr-xql-network-connection-query — Query network connections between a source IP, destination IP and port.
- xdr-xql-process-causality-network-activity-query — Search for network connection created by a given process causality ID.
- xdr-xql-process-event-query — Query process events by the SHA256 process.
- xdr-xql-process-instance-network-activity-query — Search for network connection created by a given process instance ID.
- xdr-xql-registry-query — Query windows registry by registry key name.