Cortex XDR - Search And Block Software - XQL Engine

This playbook will search a file or process activity of a software by a given image file name using Cortex XDR XQL Engine. The analyst can then choose the files to block.

Cortex XDR by Palo Alto Networks · 20 tasks · 2 inputs · 0 outputs

Inputs

  • Filename — File name to search.
  • TimeFrame — Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 24 hours.

Commands used

xdr-xql-generic-query

Flowchart

yes yes Yes - All Yes - Choose specific files yes yes Start Start Has Query Results? Has Query Results? Done Done delete context - XDR Results - DeleteContext delete context - XDR Results DeleteContext Has software name and timeframe from input? Has software name and tim... Execute XQL query to search software - xdr-xql-generic-query Execute XQL query to sear... xdr-xql-generic-query Would you like to block the files found? Would you like to block t... Block the files? Block the files? Choose specific files to block Choose specific files to ... Set Indicators To Block - Set Set Indicators To Block Set delete context - Indicators To block - DeleteContext delete context - Indicato... DeleteContext Set Indicators To Block - Files - Set Set Indicators To Block -... Set Set Indicators To Block - Process - Set Set Indicators To Block -... Set has relevant files to block has relevant files to block has relevant files to block has relevant files to block Set query results to layout - JsonToTable Set query results to layout JsonToTable Delete context - markdown - DeleteContext Delete context - markdown DeleteContext Cortex XDR - Block File - Cortex XDR - Block File Cortex XDR - Block File Cortex XDR - Block File Delete context to avoid duplications - customquerymarkdown - DeleteContext Delete context to avoid d... DeleteContext Delete context to avoid duplications - PaloAltoNetworksXQL - DeleteContext Delete context to avoid d... DeleteContext