Proactive Threat Hunting - Execute Query

This playbook will be executed from the "Proactive Threat Hunting" layout button with the objective of executing a query that will be provided by the analyst. The playbook supports executing a query using the following integrations: - Cortex XDR XQL Engine - Microsoft Defender For Endpoint

Proactive Threat Hunting · 16 tasks · 0 inputs · 0 outputs

Commands used

microsoft-atp-advanced-hunting setIncident xdr-xql-generic-query

Flowchart

yes yes yes yes Start Start Print update to notes - Print Print update to notes Print Please provide query to execute Please provide query to e... Done Done Is Cortex XDR Query Engine enabled? Is Cortex XDR Query Engin... Execute custom query - XQL Engine - xdr-xql-generic-query Execute custom query - XQ... xdr-xql-generic-query Set custom query results to layout - JsonToTable Set custom query results ... JsonToTable Delete context to avoid duplications - PaloAltoNetworksXQL - DeleteContext Delete context to avoid d... DeleteContext Delete context to avoid duplications - customquerymarkdown - DeleteContext Delete context to avoid d... DeleteContext Has custom query results? Has custom query results? Delete context to avoid duplications - "Please provide query to execute" - DeleteContext Delete context to avoid d... DeleteContext Execute custom query - Microsoft defender - microsoft-atp-advanced-hunting Execute custom query - Mi... microsoft-atp-advanced-hunting Is Microsoft Defender enabled? Is Microsoft Defender ena... Has custom query results? Has custom query results? Set custom query results to layout - JsonToTable Set custom query results ... JsonToTable Set no results found - setIncident Set no results found setIncident