sectionorder: - Connect - Collect defaultEnabled: true category: Endpoint provider: Palo Alto Networks commonfields: id: XQL Query Engine version: -1 configuration: - display: Server URL name: url type: 0 hidden: true required: false section: Connect - display: API Key ID name: apikey_id type: 4 hidden: true required: false section: Connect - display: API Key name: apikey type: 4 hidden: true required: false section: Connect description: XQL Query Engine enables you to run XQL queries on your data sources. display: XQL Query Engine name: XQL Query Engine script: commands: - arguments: - description: XQL query string. By default up to 100 results are returned. To retrieve more results, enter a custom limit in the query. name: query required: true - description: 'Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 24 hours.' name: time_frame - description: |- List of strings used for running APIs on local and Managed Security tenants. Valid values: For single tenant (local tenant) query, enter a single-item list with your tenant_id. Additional valid values are, empty list ([]) or null (default). For multi-tenant investigations (Managed Security parent who investigate children and\or local), enter a multi-item list with the required tenant_id. List of IDs can contain the parent, children, or both parent and children. isArray: true name: tenant_id - description: Interval in seconds between each poll. name: interval_in_seconds - description: Polling timeout in seconds. name: timeout_in_seconds - description: The maximum number of returned fields per result. name: max_fields defaultValue: 20 - description: The name of the query. name: query_name required: true - description: Whether to extract more than 1000 query results as JSON data to context instead of returning a .gz file. name: parse_result_file_to_context auto: PREDEFINED predefined: - "true" - "false" defaultValue: "false" - description: The ID of the source that initiated the query. Relevant only when running from a playbook. When provided, this value is reported instead of the automatically detected playbook ID. name: source_id - description: The name of the source that initiated the query. Relevant only when running from a playbook. When provided, this value is reported instead of the automatically detected playbook name. name: source_name description: |- Execute an XQL query and retrieve results of an executed XQL query API. The command will be executed every 10 seconds until results are retrieved or until a timeout error is raised. When more than 1000 results are retrieved, the command will return a compressed gzipped JSON format file, unless the argument 'parse_result_file_to_context' is set to true and then the results will be extracted to the context. polling: true name: xdr-xql-generic-query outputs: - contextPath: PaloAltoNetworksXQL.GenericQuery.execution_id description: An integer representing a unique ID of a successful XQL query execution. The execution_id value can be passed to the xdr-xql-get-query-results command. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.query_name description: The given name of the query. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.status description: |- String representing the status of the API call; SUCCESS, FAIL, or PENDING. For multi-tenant queries, PARTIAL_SUCCESS means that at least one tenant failed to execute the query. Only partial results are available. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.number_of_results description: Integer representing the number of results returned. type: Number - contextPath: PaloAltoNetworksXQL.GenericQuery.query_cost description: |- Floating number representing the number of query units collected for this API. For example, {"local_tenant_id": 0.01}. For multi-tenant queries, the field displays a value per child tenant. For example, {"tenant_id_1": 0.01, "tenant_id_2": 2.3}. type: Unknown - contextPath: PaloAltoNetworksXQL.GenericQuery.remaining_quota description: Floating number representing the number of query units available for you to use. type: Number - contextPath: PaloAltoNetworksXQL.GenericQuery.results._time description: Result time. type: Date - contextPath: PaloAltoNetworksXQL.GenericQuery.results.agent_hostname description: The agent host name. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.agent_ip_addresses description: The agent IP addresses. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.mac description: Host MAC address. type: Unknown - contextPath: PaloAltoNetworksXQL.GenericQuery.results.actor_effective_username description: Parent user name. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.actor_process_image_name description: The name of the process that initiated the activity. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.actor_process_image_path description: Path of the initiating process. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.actor_process_command_line description: Command line arguments of the initiator. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.actor_process_os_pid description: Initiator process ID. type: Number - contextPath: PaloAltoNetworksXQL.GenericQuery.results.actor_process_image_sha256 description: The SHA256 value of the initiator. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.actor_process_signature_vendor description: Initiator signer. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.actor_process_signature_status description: 'Signing status of the initiator. Possible values: Unsigned, Signed, Invalid Signature, and Unknown.' type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.causality_actor_process_image_name description: The name of the process that initiated the causality chain. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.causality_actor_process_image_path description: Causality group owner path of the initiating process. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.causality_actor_process_command_line description: Command line arguments of the causality group owner. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.causality_actor_process_os_pid description: Causality group owner process ID. type: Number - contextPath: PaloAltoNetworksXQL.GenericQuery.results.causality_actor_process_image_sha256 description: The SHA256 value of the causality group owner. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.causality_actor_process_signature_vendor description: Causality group owner signer. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.causality_actor_process_signature_status description: 'Signing status of the causality group owner. Possible values: Unsigned, Signed, Invalid Signature, and Unknown.' type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.causality_actor_type description: The type of the causality group owner. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.os_actor_process_image_name description: The name of the operating system that initiated the activity. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.os_actor_process_image_path description: Operating system parent path. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.os_actor_process_command_line description: Command line arguments of the operating system parent. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.os_actor_process_os_pid description: Operating system parent process ID. type: Number - contextPath: PaloAltoNetworksXQL.GenericQuery.results.action_remote_process_image_sha256 description: The SHA256 value of the operating system parent. type: Unknown - contextPath: PaloAltoNetworksXQL.GenericQuery.results._vendor description: The result vendor. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results._product description: The result product. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.agent_install_type description: Initiator install type. type: String - description: Retrieve the amount of query quota available and used. name: xdr-xql-get-quota outputs: - contextPath: PaloAltoNetworksXQL.Quota.license_quota description: Amount of daily quota allocated to your tenant based on your license type and size. type: Number - contextPath: PaloAltoNetworksXQL.Quota.additional_purchased_quota description: Amount of query quota purchased. type: Number - contextPath: PaloAltoNetworksXQL.Quota.used_quota description: Amount of query quota used over the past 24 hours. type: Number - contextPath: PaloAltoNetworksXQL.Quota.eval_quota description: Amount of evaluation query quota. type: Number - contextPath: PaloAltoNetworksXQL.Quota.total_daily_running_queries description: Total number of daily running queries. type: Number - contextPath: PaloAltoNetworksXQL.Quota.total_daily_concurrent_rejected_queries description: Total number of daily concurrent rejected queries. type: Number - contextPath: PaloAltoNetworksXQL.Quota.current_concurrent_active_queries description: Currently active concurrent queries with their XQL statements and durations. type: Unknown - contextPath: PaloAltoNetworksXQL.Quota.current_concurrent_active_queries_count description: Amount of currently active concurrent queries. type: Number - contextPath: PaloAltoNetworksXQL.Quota.max_daily_concurrent_active_query_count description: Maximum number of daily concurrent active queries. type: Number - arguments: - description: Integer representing the unique execution ID generated by the response to start an XQL query API. name: query_id required: true - description: The maximum number of returned fields per result. name: max_fields defaultValue: 20 - description: Whether to extract more than 1000 query results as JSON data to context instead of returning a .gz file. name: parse_result_file_to_context auto: PREDEFINED predefined: - "true" - "false" defaultValue: "false" - description: The XQL query. name: query hidden: true - description: Time in relative date or range format. name: time_frame hidden: true - description: Polling timeout in seconds. name: timeout_in_seconds - description: The name of the command. name: command_name hidden: true - description: The name of the query. name: query_name hidden: true description: |- Retrieve results of an executed XQL query API. The command will be executed every 10 seconds until results are retrieved or until a timeout error is raised. When more than 1000 results are retrieved, the command will return a compressed gzipped JSON format file, unless the argument 'parse_result_file_to_context' is set to true and then the results will be extracted to the context. polling: true name: xdr-xql-get-query-results outputs: - contextPath: PaloAltoNetworksXQL.GenericQuery.execution_id description: An integer representing a unique ID of a successful XQL query execution. The execution_id value can be passed to the xdr-xql-get-query-results command. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.query_name description: The given name of the query. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.status description: |- String representing the status of the API call; SUCCESS, FAIL, or PENDING. For multi-tenant queries, PARTIAL_SUCCESS means that at least one tenant failed to execute the query. Only partial results are available. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.number_of_results description: Integer representing the number of results returned. type: Number - contextPath: PaloAltoNetworksXQL.GenericQuery.query_cost description: |- Floating number representing the number of query units collected for this API. For example, {"local_tenant_id": 0.01}. For multi-tenant queries, the field displays a value per child tenant. For example, {"tenant_id_1": 0.01, "tenant_id_2": 2.3}. type: Unknown - contextPath: PaloAltoNetworksXQL.GenericQuery.remaining_quota description: Floating number representing the number of query units available for you to use. type: Number - contextPath: PaloAltoNetworksXQL.GenericQuery.results._time description: Result time. type: Date - contextPath: PaloAltoNetworksXQL.GenericQuery.results.agent_hostname description: The agent host name. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.agent_ip_addresses description: The agent IP addresses. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.mac description: Host MAC address. type: Unknown - contextPath: PaloAltoNetworksXQL.GenericQuery.results.actor_effective_username description: Parent user name. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.actor_process_image_name description: The name of the process that initiated the activity. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.actor_process_image_path description: Path of the initiating process. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.actor_process_command_line description: Command line arguments of the initiator. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.actor_process_os_pid description: Initiator process ID. type: Number - contextPath: PaloAltoNetworksXQL.GenericQuery.results.actor_process_image_sha256 description: The SHA256 value of the initiator. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.actor_process_signature_vendor description: Initiator signer. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.actor_process_signature_status description: 'Signing status of the initiator. Possible values: Unsigned, Signed, Invalid Signature, and Unknown.' type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.causality_actor_process_image_name description: The name of the process that initiated the causality chain. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.causality_actor_process_image_path description: Causality group owner path of the initiating process. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.causality_actor_process_command_line description: Command line arguments of the causality group owner. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.causality_actor_process_os_pid description: Causality group owner process ID. type: Number - contextPath: PaloAltoNetworksXQL.GenericQuery.results.causality_actor_process_image_sha256 description: The SHA256 value of the causality group owner. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.causality_actor_process_signature_vendor description: Causality group owner signer. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.causality_actor_process_signature_status description: 'Signing status of the causality group owner. Possible values: Unsigned, Signed, Invalid Signature, and Unknown.' type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.causality_actor_type description: The type of the causality group owner. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.os_actor_process_image_name description: The name of the operating system that initiated the activity. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.os_actor_process_image_path description: Operating system parent path. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.os_actor_process_command_line description: Command line arguments of the operating system parent. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.os_actor_process_os_pid description: Operating system parent process ID. type: Number - contextPath: PaloAltoNetworksXQL.GenericQuery.results.action_remote_process_image_sha256 description: The SHA256 value of the operating system parent. type: Unknown - contextPath: PaloAltoNetworksXQL.GenericQuery.results._vendor description: The result vendor. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results._product description: The result product. type: String - contextPath: PaloAltoNetworksXQL.GenericQuery.results.agent_install_type description: Initiator install type. type: String - arguments: - description: XDR endpoint ID to run the query on. isArray: true name: endpoint_id - description: SHA256 file to run the query on. isArray: true name: file_sha256 required: true - description: Extra fields to add to the query results. isArray: true name: extra_fields - description: 'Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 24 hours.' name: time_frame - description: |- Integer representing the maximum number of results to return. For example: If limit = 100 and the query produced 1,000 results, only the first 100 results will be returned. If limit = 100 and the query produced 50 results, only 50 results will be returned. If limit=5000, 5,000 results are returned. If limit=null or empty (default) up to 100 results are returned. name: limit defaultValue: 100 - description: |- List of strings used for running APIs on local and Managed Security tenants. Valid values: For single tenant (local tenant) query, enter a single-item list with your tenant_id. Additional valid values are, empty list ([]) or null (default). For multi-tenant investigations (Managed Security parent who investigate children and\or local), enter a multi-item list with the required tenant_id. List of IDs can contain the parent, children, or both parent and children. isArray: true name: tenant_id - description: The name of the query. name: query_name required: true - description: Whether to extract more than 1000 query results as JSON data to context instead of returning a .gz file. name: parse_result_file_to_context auto: PREDEFINED predefined: - "true" - "false" defaultValue: "false" description: Query file events by the SHA256 file. polling: true name: xdr-xql-file-event-query outputs: - contextPath: PaloAltoNetworksXQL.FileEvent.query_name description: The given name of the query. type: String - contextPath: PaloAltoNetworksXQL.FileEvent.execution_id description: An integer representing a unique ID of a successful XQL query execution. The execution_id value can be passed to the xdr-xql-get-query-results command. type: String - contextPath: PaloAltoNetworksXQL.FileEvent.status description: |- String representing the status of the API call; SUCCESS, FAIL, or PENDING. For multi-tenant queries, PARTIAL_SUCCESS means that at least one tenant failed to execute the query. Only partial results are available. type: String - contextPath: PaloAltoNetworksXQL.FileEvent.number_of_results description: Integer representing the number of results returned. type: Number - contextPath: PaloAltoNetworksXQL.FileEvent.query_cost description: |- Floating number representing the number of query units collected for this API. For example, {"local_tenant_id": 0.01}. For multi-tenant queries, the field displays a value per child tenant. For example, {"tenant_id_1": 0.01, "tenant_id_2": 2.3}. type: Unknown - contextPath: PaloAltoNetworksXQL.FileEvent.remaining_quota description: Floating number representing the number of query units available for you to use. type: Number - contextPath: PaloAltoNetworksXQL.FileEvent.results.agent_hostname description: The agent host name. type: String - contextPath: PaloAltoNetworksXQL.FileEvent.results.agent_ip_addresses description: The agent IP addresses. type: String - contextPath: PaloAltoNetworksXQL.FileEvent.results.agent_id description: Endpoint ID. type: String - contextPath: PaloAltoNetworksXQL.FileEvent.results.action_file_path description: File path of the action. type: String - contextPath: PaloAltoNetworksXQL.FileEvent.results.action_file_sha256 description: SHA256 hash value of the file. type: String - contextPath: PaloAltoNetworksXQL.FileEvent.results.actor_process_file_create_time description: Initiator file create time. type: String - contextPath: PaloAltoNetworksXQL.FileEvent.results._vendor description: The result vendor. type: String - contextPath: PaloAltoNetworksXQL.FileEvent.results._time description: Result time. type: String - contextPath: PaloAltoNetworksXQL.FileEvent.results.insert_timestamp description: Result insert timestamp. type: String - contextPath: PaloAltoNetworksXQL.FileEvent.results._product description: The result product. type: String - arguments: - description: XDR endpoint ID to run the query on. isArray: true name: endpoint_id - description: The SHA256 hash of the primary involved process to search on the XDR dataset. isArray: true name: process_sha256 required: true - description: Extra fields to add to the query results. isArray: true name: extra_fields - description: 'Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 24 hours.' name: time_frame - description: |- Integer representing the maximum number of results to return. For example: If limit = 100 and the query produced 1,000 results, only the first 100 results will be returned. If limit = 100 and the query produced 50 results, only 50 results will be returned. If limit=5000, 5,000 results are returned. If limit=null or empty (default) up to 100 results are returned. name: limit defaultValue: 100 - description: |- List of strings used for running APIs on local and Managed Security tenants. Valid values: For single tenant (local tenant) query, enter a single-item list with your tenant_id. Additional valid values are, empty list ([]) or null (default). For multi-tenant investigations (Managed Security parent who investigate children and\or local), enter a multi-item list with the required tenant_id. List of IDs can contain the parent, children, or both parent and children. isArray: true name: tenant_id - description: The name of the query. name: query_name required: true - description: Whether to extract more than 1000 query results as JSON data to context instead of returning a .gz file. name: parse_result_file_to_context auto: PREDEFINED predefined: - "true" - "false" defaultValue: "false" description: Query process events by the SHA256 process. polling: true name: xdr-xql-process-event-query outputs: - contextPath: PaloAltoNetworksXQL.ProcessEvent.query_name description: The given name of the query. type: String - contextPath: PaloAltoNetworksXQL.ProcessEvent.execution_id description: An integer representing a unique ID of a successful XQL query execution. The execution_id value can be passed to the xdr-xql-get-query-results command. type: String - contextPath: PaloAltoNetworksXQL.ProcessEvent.status description: |- String representing the status of the API call; SUCCESS, FAIL, or PENDING. For multi-tenant queries, PARTIAL_SUCCESS means that at least one tenant failed to execute the query. Only partial results are available. type: String - contextPath: PaloAltoNetworksXQL.ProcessEvent.number_of_results description: Integer representing the number of results returned. type: Number - contextPath: PaloAltoNetworksXQL.ProcessEvent.query_cost description: |- Floating number representing the number of query units collected for this API. For example, {"local_tenant_id": 0.01}. For multi-tenant queries, the field displays a value per child tenant. For example, {"tenant_id_1": 0.01, "tenant_id_2": 2.3}. type: Unknown - contextPath: PaloAltoNetworksXQL.ProcessEvent.remaining_quota description: Floating number representing the number of query units available for you to use. type: Number - contextPath: PaloAltoNetworksXQL.ProcessEvent.results.agent_hostname description: The agent host name. type: String - contextPath: PaloAltoNetworksXQL.ProcessEvent.results.agent_ip_addresses description: The agent IP addresses. type: String - contextPath: PaloAltoNetworksXQL.ProcessEvent.results.agent_id description: Endpoint ID. type: String - contextPath: PaloAltoNetworksXQL.ProcessEvent.results.action_process_image_sha256 description: Target SHA256 process. type: String - contextPath: PaloAltoNetworksXQL.ProcessEvent.results.action_process_image_name description: Target process name. type: String - contextPath: PaloAltoNetworksXQL.ProcessEvent.results.action_process_image_path description: Target process image path. type: String - contextPath: PaloAltoNetworksXQL.ProcessEvent.results.action_process_instance_id description: Target process instance ID. type: String - contextPath: PaloAltoNetworksXQL.ProcessEvent.results.action_process_causality_id description: Target process causality ID. type: String - contextPath: PaloAltoNetworksXQL.ProcessEvent.results.action_process_signature_vendor description: Process execution signer. type: String - contextPath: PaloAltoNetworksXQL.ProcessEvent.results.action_process_signature_product description: Process signature product. type: String - contextPath: PaloAltoNetworksXQL.ProcessEvent.results.action_process_image_command_line description: Target process command line. type: String - contextPath: PaloAltoNetworksXQL.ProcessEvent.results.actor_process_image_name description: The name of the process that initiated the activity. type: String - contextPath: PaloAltoNetworksXQL.ProcessEvent.results.actor_process_image_path description: Path of the initiating process. type: String - contextPath: PaloAltoNetworksXQL.ProcessEvent.results.actor_process_instance_id description: Initiator instance ID. type: String - contextPath: PaloAltoNetworksXQL.ProcessEvent.results.actor_process_causality_id description: Initiator causality ID. type: String - contextPath: PaloAltoNetworksXQL.ProcessEvent.results._vendor description: The result vendor. type: String - contextPath: PaloAltoNetworksXQL.ProcessEvent.results._time description: Result time. type: String - contextPath: PaloAltoNetworksXQL.ProcessEvent.results.insert_timestamp description: Result insert timestamp. type: String - contextPath: PaloAltoNetworksXQL.ProcessEvent.results._product description: The result product. type: String - arguments: - description: XDR endpoint ID to run the query on. isArray: true name: endpoint_id - description: SHA256 DLL module to search on the XDR dataset. isArray: true name: loaded_module_sha256 required: true - description: Extra fields to add to the query results. isArray: true name: extra_fields - description: 'Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 24 hours.' name: time_frame - description: |- Integer representing the maximum number of results to return. For example: If limit = 100 and the query produced 1,000 results, only the first 100 results will be returned. If limit = 100 and the query produced 50 results, only 50 results will be returned. If limit=5000, 5,000 results are returned. If limit=null or empty (default) up to 100 results are returned. name: limit defaultValue: 100 - description: |- List of strings used for running APIs on local and Managed Security tenants. Valid values: For single tenant (local tenant) query, enter a single-item list with your tenant_id. Additional valid values are, empty list ([]) or null (default). For multi-tenant investigations (Managed Security parent who investigate children and\or local), enter a multi-item list with the required tenant_id. List of IDs can contain the parent, children, or both parent and children. isArray: true name: tenant_id - description: The name of the query. name: query_name required: true - description: Whether to extract more than 1000 query results as JSON data to context instead of returning a .gz file. name: parse_result_file_to_context auto: PREDEFINED predefined: - "true" - "false" defaultValue: "false" description: Query DLL module events by the SHA256 DLL. polling: true name: xdr-xql-dll-module-query outputs: - contextPath: PaloAltoNetworksXQL.DllModule.query_name description: The given name of the query. type: String - contextPath: PaloAltoNetworksXQL.DllModule.execution_id description: An integer representing a unique ID of a successful XQL query execution. The execution_id value can be passed to the xdr-xql-get-query-results command. type: String - contextPath: PaloAltoNetworksXQL.DllModule.status description: |- String representing the status of the API call; SUCCESS, FAIL, or PENDING. For multi-tenant queries, PARTIAL_SUCCESS means that at least one tenant failed to execute the query. Only partial results are available. type: String - contextPath: PaloAltoNetworksXQL.DllModule.number_of_results description: Integer representing the number of results returned. type: Number - contextPath: PaloAltoNetworksXQL.DllModule.query_cost description: |- Floating number representing the number of query units collected for this API. For example, {"local_tenant_id": 0.01}. For multi-tenant queries, the field displays a value per child tenant. For example, {"tenant_id_1": 0.01, "tenant_id_2": 2.3}. type: Unknown - contextPath: PaloAltoNetworksXQL.DllModule.remaining_quota description: Floating number representing the number of query units available for you to use. type: Number - contextPath: PaloAltoNetworksXQL.DllModule.results.agent_hostname description: The agent host name. type: String - contextPath: PaloAltoNetworksXQL.DllModule.results.agent_ip_addresses description: The agent IP addresses. type: String - contextPath: PaloAltoNetworksXQL.DllModule.results.agent_id description: Endpoint ID. type: String - contextPath: PaloAltoNetworksXQL.DllModule.results.actor_effective_username description: Parent user name. type: String - contextPath: PaloAltoNetworksXQL.DllModule.results.action_module_sha256 description: Action SHA256 module. type: String - contextPath: PaloAltoNetworksXQL.DllModule.results.action_module_path description: Action module path. type: String - contextPath: PaloAltoNetworksXQL.DllModule.results.action_module_file_info description: Action module file information. type: String - contextPath: PaloAltoNetworksXQL.DllModule.results.action_module_file_create_time description: Action module file create time. type: String - contextPath: PaloAltoNetworksXQL.DllModule.results.actor_process_image_name description: The name of the process that initiated the activity. type: String - contextPath: PaloAltoNetworksXQL.DllModule.results.actor_process_image_path description: Path of the initiating process. type: String - contextPath: PaloAltoNetworksXQL.DllModule.results.actor_process_command_line description: Command line arguments of the initiator. type: String - contextPath: PaloAltoNetworksXQL.DllModule.results.actor_process_image_sha256 description: The SHA256 value of the initiator. type: String - contextPath: PaloAltoNetworksXQL.DllModule.results.actor_process_instance_id description: Initiator instance ID. type: String - contextPath: PaloAltoNetworksXQL.DllModule.results.actor_process_causality_id description: Initiator causality ID. type: String - contextPath: PaloAltoNetworksXQL.DllModule.results._vendor description: The result vendor. type: String - contextPath: PaloAltoNetworksXQL.DllModule.results._time description: Result time. type: String - contextPath: PaloAltoNetworksXQL.DllModule.results.insert_timestamp description: Result insert timestamp. type: String - contextPath: PaloAltoNetworksXQL.DllModule.results._product description: The result product. type: String - arguments: - description: XDR endpoint ID to run the query on. isArray: true name: endpoint_id - description: Source IP of the network connection query. isArray: true name: local_ip - description: Destination IP of the network connection query. isArray: true name: remote_ip required: true - description: Destination port of the network connection query. isArray: true name: port - description: Extra fields to add to the query results. isArray: true name: extra_fields - description: 'Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 24 hours.' name: time_frame - description: |- Integer representing the maximum number of results to return. For example: If limit = 100 and the query produced 1,000 results, only the first 100 results will be returned. If limit = 100 and the query produced 50 results, only 50 results will be returned. If limit=5000, 5,000 results are returned. If limit=null or empty (default) up to 100 results are returned. name: limit defaultValue: 100 - description: |- List of strings used for running APIs on local and Managed Security tenants. Valid values: For single tenant (local tenant) query, enter a single-item list with your tenant_id. Additional valid values are, empty list ([]) or null (default). For multi-tenant investigations (Managed Security parent who investigate children and\or local), enter a multi-item list with the required tenant_id. List of IDs can contain the parent, children, or both parent and children. isArray: true name: tenant_id - description: The name of the query. name: query_name required: true - description: Whether to extract more than 1000 query results as JSON data to context instead of returning a .gz file. name: parse_result_file_to_context auto: PREDEFINED predefined: - "true" - "false" defaultValue: "false" description: Query network connections between a source IP, destination IP and port. polling: true name: xdr-xql-network-connection-query outputs: - contextPath: PaloAltoNetworksXQL.NetworkConnection.query_name description: The given name of the query. type: String - contextPath: PaloAltoNetworksXQL.NetworkConnection.execution_id description: An integer representing a unique ID of a successful XQL query execution. The execution_id value can be passed to the xdr-xql-get-query-results command. type: String - contextPath: PaloAltoNetworksXQL.NetworkConnection.status description: |- String representing the status of the API call; SUCCESS, FAIL, or PENDING. For multi-tenant queries, PARTIAL_SUCCESS means that at least one tenant failed to execute the query. Only partial results are available. type: String - contextPath: PaloAltoNetworksXQL.NetworkConnection.number_of_results description: Integer representing the number of results returned. type: Number - contextPath: PaloAltoNetworksXQL.NetworkConnection.query_cost description: |- Floating number representing the number of query units collected for this API. For example, {"local_tenant_id": 0.01}. For multi-tenant queries, the field displays a value per child tenant. For example, {"tenant_id_1": 0.01, "tenant_id_2": 2.3}. type: Unknown - contextPath: PaloAltoNetworksXQL.NetworkConnection.remaining_quota description: Floating number representing the number of query units available for you to use. type: Number - contextPath: PaloAltoNetworksXQL.NetworkConnection.results.agent_hostname description: The agent host name. type: String - contextPath: PaloAltoNetworksXQL.NetworkConnection.results.agent_ip_addresses description: The agent IP addresses. type: String - contextPath: PaloAltoNetworksXQL.NetworkConnection.results.agent_id description: Endpoint ID. type: String - contextPath: PaloAltoNetworksXQL.NetworkConnection.results.actor_effective_username description: Parent user name. type: String - contextPath: PaloAltoNetworksXQL.NetworkConnection.results.action_local_ip description: Local IP address. type: String - contextPath: PaloAltoNetworksXQL.NetworkConnection.results.action_remote_ip description: Remote IP address. type: String - contextPath: PaloAltoNetworksXQL.NetworkConnection.results.action_remote_port description: Remote port. type: String - contextPath: PaloAltoNetworksXQL.NetworkConnection.results.dst_action_external_hostname description: External hostname. type: String - contextPath: PaloAltoNetworksXQL.NetworkConnection.results.action_country description: Action country. type: String - contextPath: PaloAltoNetworksXQL.NetworkConnection.results.actor_process_image_name description: The name of the process that initiated the activity. type: String - contextPath: PaloAltoNetworksXQL.NetworkConnection.results.actor_process_image_path description: Path of the initiating process. type: String - contextPath: PaloAltoNetworksXQL.NetworkConnection.results.actor_process_command_line description: Command line arguments of the initiator. type: String - contextPath: PaloAltoNetworksXQL.NetworkConnection.results.actor_process_image_sha256 description: The SHA256 value of the initiator. type: String - contextPath: PaloAltoNetworksXQL.NetworkConnection.results.actor_process_instance_id description: Initiator instance ID. type: String - contextPath: PaloAltoNetworksXQL.NetworkConnection.results.actor_process_causality_id description: Initiator causality ID. type: String - contextPath: PaloAltoNetworksXQL.NetworkConnection.results._vendor description: The result vendor. type: String - contextPath: PaloAltoNetworksXQL.NetworkConnection.results._time description: Result time. type: String - contextPath: PaloAltoNetworksXQL.NetworkConnection.results.insert_timestamp description: Result insert timestamp. type: String - contextPath: PaloAltoNetworksXQL.NetworkConnection.results._product description: The result product. type: String - arguments: - description: XDR endpoint ID to run the query on. isArray: true name: endpoint_id - description: 'Registry key name to search (for example: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Environments\Windows x64\Drivers\Version-3\Remote Desktop Easy Print).' isArray: true name: reg_key_name required: true - description: Extra fields to add to the query results. isArray: true name: extra_fields - description: 'Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 24 hours.' name: time_frame - description: |- Integer representing the maximum number of results to return. For example: If limit = 100 and the query produced 1,000 results, only the first 100 results will be returned. If limit = 100 and the query produced 50 results, only 50 results will be returned. If limit=5000, 5,000 results are returned. If limit=null or empty (default) up to 100 results are returned. name: limit defaultValue: 100 - description: |- List of strings used for running APIs on local and Managed Security tenants. Valid values: For single tenant (local tenant) query, enter a single-item list with your tenant_id. Additional valid values are, empty list ([]) or null (default). For multi-tenant investigations (Managed Security parent who investigate children and\or local), enter a multi-item list with the required tenant_id. List of IDs can contain the parent, children, or both parent and children. isArray: true name: tenant_id - description: The name of the query. name: query_name required: true - description: Whether to extract more than 1000 query results as JSON data to context instead of returning a .gz file. name: parse_result_file_to_context auto: PREDEFINED predefined: - "true" - "false" defaultValue: "false" description: Query windows registry by registry key name. polling: true name: xdr-xql-registry-query outputs: - contextPath: PaloAltoNetworksXQL.Registry.query_name description: The given name of the query. type: String - contextPath: PaloAltoNetworksXQL.Registry.execution_id description: An integer representing a unique ID of a successful XQL query execution. The execution_id value can be passed to the xdr-xql-get-query-results command. type: String - contextPath: PaloAltoNetworksXQL.Registry.status description: |- String representing the status of the API call; SUCCESS, FAIL, or PENDING. For multi-tenant queries, PARTIAL_SUCCESS means that at least one tenant failed to execute the query. Only partial results are available. type: String - contextPath: PaloAltoNetworksXQL.Registry.number_of_results description: Integer representing the number of results returned. type: Number - contextPath: PaloAltoNetworksXQL.Registry.query_cost description: |- Floating number representing the number of query units collected for this API. For example, {"local_tenant_id": 0.01}. For multi-tenant queries, the field displays a value per child tenant. For example, {"tenant_id_1": 0.01, "tenant_id_2": 2.3}. type: Unknown - contextPath: PaloAltoNetworksXQL.Registry.remaining_quota description: Floating number representing the number of query units available for you to use. type: Number - contextPath: PaloAltoNetworksXQL.Registry.results.agent_hostname description: The agent host name. type: String - contextPath: PaloAltoNetworksXQL.Registry.results.agent_ip_addresses description: The agent IP addresses. type: String - contextPath: PaloAltoNetworksXQL.Registry.results.agent_id description: Endpoint ID. type: String - contextPath: PaloAltoNetworksXQL.Registry.results.agent_os_type description: Host operating system. type: String - contextPath: PaloAltoNetworksXQL.Registry.results.agent_os_sub_type description: Agent operating system subtype. type: String - contextPath: PaloAltoNetworksXQL.Registry.results.event_type description: Event type. type: String - contextPath: PaloAltoNetworksXQL.Registry.results.event_sub_type description: Event subtype. type: String - contextPath: PaloAltoNetworksXQL.Registry.results.action_registry_key_name description: Registry key name. type: String - contextPath: PaloAltoNetworksXQL.Registry.results.action_registry_value_name description: Registry value name. type: String - contextPath: PaloAltoNetworksXQL.Registry.results.action_registry_data description: Registry data. type: String - contextPath: PaloAltoNetworksXQL.Registry.results._vendor description: The result vendor. type: String - contextPath: PaloAltoNetworksXQL.Registry.results._time description: Result time. type: String - contextPath: PaloAltoNetworksXQL.Registry.results.insert_timestamp description: Result insert timestamp. type: String - contextPath: PaloAltoNetworksXQL.Registry.results._product description: The result product. type: String - arguments: - description: XDR endpoint ID to run the query on. isArray: true name: endpoint_id - description: 'Event log ID to search. - Windows: Event ID of the event-log - Linux: For action_evtlog_source = AuthLog, one of the following: 0 = Unknown 1 = Successful Login 2 = Failed Login 3 = Failed Password (Same as failed login, but should include a username) 4 = Logout.' isArray: true name: event_id required: true - description: Extra fields to add to the query results. isArray: true name: extra_fields - description: 'Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 24 hours.' name: time_frame - description: |- Integer representing the maximum number of results to return. For example: If limit = 100 and the query produced 1,000 results, only the first 100 results will be returned. If limit = 100 and the query produced 50 results, only 50 results will be returned. If limit=5000, 5,000 results are returned. If limit=null or empty (default) up to 100 results are returned. name: limit defaultValue: 100 - description: |- List of strings used for running APIs on local and Managed Security tenants. Valid values: For single tenant (local tenant) query, enter a single-item list with your tenant_id. Additional valid values are, empty list ([]) or null (default). For multi-tenant investigations (Managed Security parent who investigate children and\or local), enter a multi-item list with the required tenant_id. List of IDs can contain the parent, children, or both parent and children. isArray: true name: tenant_id - description: The name of the query. name: query_name required: true - description: Whether to extract more than 1000 query results as JSON data to context instead of returning a .gz file. name: parse_result_file_to_context auto: PREDEFINED predefined: - "true" - "false" defaultValue: "false" description: Query event logs by event ID. polling: true name: xdr-xql-event-log-query outputs: - contextPath: PaloAltoNetworksXQL.EventLog.query_name description: The given name of the query. type: String - contextPath: PaloAltoNetworksXQL.EventLog.execution_id description: An integer representing a unique ID of a successful XQL query execution. The execution_id value can be passed to the xdr-xql-get-query-results command. type: String - contextPath: PaloAltoNetworksXQL.EventLog.status description: |- String representing the status of the API call; SUCCESS, FAIL, or PENDING. For multi-tenant queries, PARTIAL_SUCCESS means that at least one tenant failed to execute the query. Only partial results are available. type: String - contextPath: PaloAltoNetworksXQL.EventLog.number_of_results description: Integer representing the number of results returned. type: Number - contextPath: PaloAltoNetworksXQL.EventLog.query_cost description: |- Floating number representing the number of query units collected for this API. For example, {"local_tenant_id": 0.01}. For multi-tenant queries, the field displays a value per child tenant. For example, {"tenant_id_1": 0.01, "tenant_id_2": 2.3}. type: Unknown - contextPath: PaloAltoNetworksXQL.EventLog.remaining_quota description: Floating number representing the number of query units available for you to use. type: Number - contextPath: PaloAltoNetworksXQL.EventLog.results.agent_hostname description: The agent host name. type: String - contextPath: PaloAltoNetworksXQL.EventLog.results.agent_ip_addresses description: The agent IP addresses. type: String - contextPath: PaloAltoNetworksXQL.EventLog.results.agent_id description: Endpoint ID. type: String - contextPath: PaloAltoNetworksXQL.EventLog.results.agent_os_type description: Host operating system. type: String - contextPath: PaloAltoNetworksXQL.EventLog.results.agent_os_sub_type description: Agent operating system subtype. type: String - contextPath: PaloAltoNetworksXQL.EventLog.results.action_evtlog_event_id description: Event log ID. type: String - contextPath: PaloAltoNetworksXQL.EventLog.results.event_type description: Event type. type: String - contextPath: PaloAltoNetworksXQL.EventLog.results.event_sub_type description: Event subtype. type: String - contextPath: PaloAltoNetworksXQL.EventLog.results.action_evtlog_message description: Event log message. type: String - contextPath: PaloAltoNetworksXQL.EventLog.results.action_evtlog_provider_name description: Event log provider name. type: String - contextPath: PaloAltoNetworksXQL.EventLog.results._vendor description: The result vendor. type: String - contextPath: PaloAltoNetworksXQL.EventLog.results._time description: Result time. type: String - contextPath: PaloAltoNetworksXQL.EventLog.results.insert_timestamp description: Result insert timestamp. type: String - contextPath: PaloAltoNetworksXQL.EventLog.results._product description: The result product. type: String - arguments: - description: XDR endpoint ID to run the query on. isArray: true name: endpoint_id - description: Query by external domain name. isArray: true name: external_domain - description: Query by DNS query. isArray: true name: dns_query - description: Extra fields to add to the query results. isArray: true name: extra_fields - description: 'Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 24 hours.' name: time_frame - description: |- Integer representing the maximum number of results to return. For example: If limit = 100 and the query produced 1,000 results, only the first 100 results will be returned. If limit = 100 and the query produced 50 results, only 50 results will be returned. If limit=5000, 5,000 results are returned. If limit=null or empty (default) up to 100 results are returned. name: limit defaultValue: 100 - description: |- List of strings used for running APIs on local and Managed Security tenants. Valid values: For single tenant (local tenant) query, enter a single-item list with your tenant_id. Additional valid values are, empty list ([]) or null (default). For multi-tenant investigations (Managed Security parent who investigate children and\or local), enter a multi-item list with the required tenant_id. List of IDs can contain the parent, children, or both parent and children. isArray: true name: tenant_id - description: The name of the query. name: query_name required: true - description: Whether to extract more than 1000 query results as JSON data to context instead of returning a .gz file. name: parse_result_file_to_context auto: PREDEFINED predefined: - "true" - "false" defaultValue: "false" description: Query by DNS query or domain name. polling: true name: xdr-xql-dns-query outputs: - contextPath: PaloAltoNetworksXQL.DNS.query_name description: The given name of the query. type: String - contextPath: PaloAltoNetworksXQL.DNS.execution_id description: An integer representing a unique ID of a successful XQL query execution. The execution_id value can be passed to the xdr-xql-get-query-results command. type: String - contextPath: PaloAltoNetworksXQL.DNS.status description: |- String representing the status of the API call; SUCCESS, FAIL, or PENDING. For multi-tenant queries, PARTIAL_SUCCESS means that at least one tenant failed to execute the query. Only partial results are available. type: String - contextPath: PaloAltoNetworksXQL.DNS.number_of_results description: Integer representing the number of results returned. type: Number - contextPath: PaloAltoNetworksXQL.DNS.query_cost description: |- Floating number representing the number of query units collected for this API. For example, {"local_tenant_id": 0.01}. For multi-tenant queries, the field displays a value per child tenant. For example, {"tenant_id_1": 0.01, "tenant_id_2": 2.3}. type: Unknown - contextPath: PaloAltoNetworksXQL.DNS.remaining_quota description: Floating number representing the number of query units available for you to use. type: Number - contextPath: PaloAltoNetworksXQL.DNS.results.agent_hostname description: The agent host name. type: String - contextPath: PaloAltoNetworksXQL.DNS.results.agent_ip_addresses description: The agent IP addresses. type: String - contextPath: PaloAltoNetworksXQL.DNS.results.agent_id description: Endpoint ID. type: String - contextPath: PaloAltoNetworksXQL.DNS.results.agent_os_type description: Host operating system. type: String - contextPath: PaloAltoNetworksXQL.DNS.results.agent_os_sub_type description: Agent operating system subtype. type: String - contextPath: PaloAltoNetworksXQL.DNS.results.action_local_ip description: Local IP address. type: String - contextPath: PaloAltoNetworksXQL.DNS.results.action_remote_ip description: Remote IP address. type: String - contextPath: PaloAltoNetworksXQL.DNS.results.action_remote_port description: Remote port. type: String - contextPath: PaloAltoNetworksXQL.DNS.results.dst_action_external_hostname description: External hostname. type: String - contextPath: PaloAltoNetworksXQL.DNS.results.dns_query_name description: DNS query name. type: String - contextPath: PaloAltoNetworksXQL.DNS.results.action_app_id_transitions description: List of application IDs action. Actual activities that took place and recorded by the agent. type: String - contextPath: PaloAltoNetworksXQL.DNS.results.action_total_download description: Total downloads. type: String - contextPath: PaloAltoNetworksXQL.DNS.results.action_total_upload description: Total uploads. type: String - contextPath: PaloAltoNetworksXQL.DNS.results.action_country description: Action country. type: String - contextPath: PaloAltoNetworksXQL.DNS.results.action_as_data description: The action as data. type: String - contextPath: PaloAltoNetworksXQL.DNS.results.os_actor_process_image_path description: Operating system parent path. type: String - contextPath: PaloAltoNetworksXQL.DNS.results.os_actor_process_command_line description: Command line arguments of the operating system parent. type: String - contextPath: PaloAltoNetworksXQL.DNS.results.os_actor_process_instance_id description: Initiator instance ID. type: String - contextPath: PaloAltoNetworksXQL.DNS.results.os_actor_process_causality_id description: Initiator causality ID. type: String - contextPath: PaloAltoNetworksXQL.DNS.results._vendor description: The result vendor. type: String - contextPath: PaloAltoNetworksXQL.DNS.results._time description: Result time. type: String - contextPath: PaloAltoNetworksXQL.DNS.results.insert_timestamp description: Result insert timestamp. type: String - contextPath: PaloAltoNetworksXQL.DNS.results._product description: The result product. type: String - arguments: - description: XDR endpoint ID to run the query on. isArray: true name: endpoint_id - description: SHA256 file to search on the XDR dataset. isArray: true name: file_sha256 - description: File path to search on the XDR dataset. isArray: true name: file_path - description: Extra fields to add to the query results. isArray: true name: extra_fields - description: 'Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 24 hours.' name: time_frame - description: |- Integer representing the maximum number of results to return. For example: If limit = 100 and the query produced 1,000 results, only the first 100 results will be returned. If limit = 100 and the query produced 50 results, only 50 results will be returned. If limit=5000, 5,000 results are returned. If limit=null or empty (default) up to 100 results are returned. name: limit defaultValue: 100 - description: |- List of strings used for running APIs on local and Managed Security tenants. Valid values: For single tenant (local tenant) query, enter a single-item list with your tenant_id. Additional valid values are, empty list ([]) or null (default). For multi-tenant investigations (Managed Security parent who investigate children and\or local), enter a multi-item list with the required tenant_id. List of IDs can contain the parent, children, or both parent and children. isArray: true name: tenant_id - description: The name of the query. name: query_name required: true - description: Whether to extract more than 1000 query results as JSON data to context instead of returning a .gz file. name: parse_result_file_to_context auto: PREDEFINED predefined: - "true" - "false" defaultValue: "false" description: Search for the process that wrote the given file, by its SHA256 or file path. polling: true name: xdr-xql-file-dropper-query outputs: - contextPath: PaloAltoNetworksXQL.FileDropper.query_name description: The given name of the query. type: String - contextPath: PaloAltoNetworksXQL.FileDropper.execution_id description: An integer representing a unique ID of a successful XQL query execution. The execution_id value can be passed to the xdr-xql-get-query-results command. type: String - contextPath: PaloAltoNetworksXQL.FileDropper.status description: |- String representing the status of the API call; SUCCESS, FAIL, or PENDING. For multi-tenant queries, PARTIAL_SUCCESS means that at least one tenant failed to execute the query. Only partial results are available. type: String - contextPath: PaloAltoNetworksXQL.FileDropper.number_of_results description: Integer representing the number of results returned. type: Number - contextPath: PaloAltoNetworksXQL.FileDropper.query_cost description: |- Floating number representing the number of query units collected for this API. For example, {"local_tenant_id": 0.01}. For multi-tenant queries, the field displays a value per child tenant. For example, {"tenant_id_1": 0.01, "tenant_id_2": 2.3}. type: Unknown - contextPath: PaloAltoNetworksXQL.FileDropper.remaining_quota description: Floating number representing the number of query units available for you to use. type: Number - contextPath: PaloAltoNetworksXQL.FileDropper.results.agent_hostname description: The agent host name. type: String - contextPath: PaloAltoNetworksXQL.FileDropper.results.agent_ip_addresses description: The agent IP addresses. type: String - contextPath: PaloAltoNetworksXQL.FileDropper.results.agent_id description: Endpoint ID. type: String - contextPath: PaloAltoNetworksXQL.FileDropper.results.action_file_sha256 description: SHA256 hash value of the file. type: String - contextPath: PaloAltoNetworksXQL.FileDropper.results.action_file_path description: File path of the action. type: String - contextPath: PaloAltoNetworksXQL.FileDropper.results.actor_process_image_name description: The name of the process that initiated the activity. type: String - contextPath: PaloAltoNetworksXQL.FileDropper.results.actor_process_image_path description: Path of the initiating process. type: String - contextPath: PaloAltoNetworksXQL.FileDropper.results.actor_process_command_line description: Command line arguments of the initiator. type: String - contextPath: PaloAltoNetworksXQL.FileDropper.results.actor_process_signature_vendor description: Initiator signer. type: String - contextPath: PaloAltoNetworksXQL.FileDropper.results.actor_process_signature_product description: Initiator product. type: String - contextPath: PaloAltoNetworksXQL.FileDropper.results.actor_process_image_sha256 description: The SHA256 value of the initiator. type: String - contextPath: PaloAltoNetworksXQL.FileDropper.results.actor_primary_normalized_user description: Normalized user. type: String - contextPath: PaloAltoNetworksXQL.FileDropper.results.os_actor_process_image_path description: Operating system parent path. type: String - contextPath: PaloAltoNetworksXQL.FileDropper.results.os_actor_process_command_line description: Command line arguments of the operating system parent. type: String - contextPath: PaloAltoNetworksXQL.FileDropper.results.os_actor_process_signature_vendor description: Operating system parent signer. type: String - contextPath: PaloAltoNetworksXQL.FileDropper.results.os_actor_process_signature_product description: Operating system parent signer product. type: String - contextPath: PaloAltoNetworksXQL.FileDropper.results.os_actor_process_image_sha256 description: The SHA256 value of the operating system parent. type: String - contextPath: PaloAltoNetworksXQL.FileDropper.results.os_actor_effective_username description: Operating system parent user name. type: String - contextPath: PaloAltoNetworksXQL.FileDropper.results.causality_actor_remote_host description: Remote host. type: String - contextPath: PaloAltoNetworksXQL.FileDropper.results.causality_actor_remote_ip description: remote IP address. type: String - contextPath: PaloAltoNetworksXQL.FileDropper.results._vendor description: The result vendor. type: String - contextPath: PaloAltoNetworksXQL.FileDropper.results._time description: Result time. type: String - contextPath: PaloAltoNetworksXQL.FileDropper.results.insert_timestamp description: Result insert timestamp. type: String - contextPath: PaloAltoNetworksXQL.FileDropper.results._product description: The result product. type: String - arguments: - description: XDR endpoint ID to run the query on. isArray: true name: endpoint_id - description: Process instance ID to search on the XDR dataset. isArray: true name: process_instance_id required: true - description: Extra fields to add to the query results. isArray: true name: extra_fields - description: 'Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 24 hours.' name: time_frame - description: |- Integer representing the maximum number of results to return. For example: If limit = 100 and the query produced 1,000 results, only the first 100 results will be returned. If limit = 100 and the query produced 50 results, only 50 results will be returned. If limit=5000, 5,000 results are returned. If limit=null or empty (default) up to 100 results are returned. name: limit defaultValue: 100 - description: |- List of strings used for running APIs on local and Managed Security tenants. Valid values: For single tenant (local tenant) query, enter a single-item list with your tenant_id. Additional valid values are, empty list ([]) or null (default). For multi-tenant investigations (Managed Security parent who investigate children and\or local), enter a multi-item list with the required tenant_id. List of IDs can contain the parent, children, or both parent and children. isArray: true name: tenant_id - description: The name of the query. name: query_name required: true - description: Whether to extract more than 1000 query results as JSON data to context instead of returning a .gz file. name: parse_result_file_to_context auto: PREDEFINED predefined: - "true" - "false" defaultValue: "false" description: Search for network connection created by a given process instance ID. polling: true name: xdr-xql-process-instance-network-activity-query outputs: - contextPath: PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.query_name description: The given name of the query. type: String - contextPath: PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.execution_id description: An integer representing a unique ID of a successful XQL query execution. The execution_id value can be passed to the xdr-xql-get-query-results command. type: String - contextPath: PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.status description: |- String representing the status of the API call; SUCCESS, FAIL, or PENDING. For multi-tenant queries, PARTIAL_SUCCESS means that at least one tenant failed to execute the query. Only partial results are available. type: String - contextPath: PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.number_of_results description: Integer representing the number of results returned. type: Number - contextPath: PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.query_cost description: |- Floating number representing the number of query units collected for this API. For example, {"local_tenant_id": 0.01}. For multi-tenant queries, the field displays a value per child tenant. For example, {"tenant_id_1": 0.01, "tenant_id_2": 2.3}. type: Unknown - contextPath: PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.remaining_quota description: Floating number representing the number of query units available for you to use. type: Number - contextPath: PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.agent_hostname description: The agent host name. type: String - contextPath: PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.agent_ip_addresses description: The agent IP addresses. type: String - contextPath: PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.agent_id description: Endpoint ID. type: String - contextPath: PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.action_local_ip description: Local IP address. type: String - contextPath: PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.action_remote_ip description: Remote IP address. type: String - contextPath: PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.action_remote_port description: Remote port. type: String - contextPath: PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.dst_action_external_hostname description: External hostname. type: String - contextPath: PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.dns_query_name description: DNS query name. type: String - contextPath: PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.action_app_id_transitions description: List of application IDs action. Actual activities that took place and recorded by the agent. type: String - contextPath: PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.action_total_download description: Total downloads. type: String - contextPath: PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.action_total_upload description: Total uploads. type: String - contextPath: PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.action_country description: Action country. type: String - contextPath: PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.action_as_data description: The action as data. type: String - contextPath: PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.actor_process_image_sha256 description: The SHA256 value of the initiator. type: String - contextPath: PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.actor_process_image_name description: The name of the process that initiated the activity. type: String - contextPath: PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.actor_process_image_path description: Path of the initiating process. type: String - contextPath: PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.actor_process_signature_vendor description: Initiator signer. type: String - contextPath: PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.actor_process_signature_product description: Initiator product. type: String - contextPath: PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.actor_causality_id description: Causality identifier (CID). type: String - contextPath: PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.actor_process_image_command_line description: Image command line. type: String - contextPath: PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.actor_process_instance_id description: Initiator instance ID. type: String - contextPath: PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results._vendor description: The result vendor. type: String - contextPath: PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results._time description: Result time. type: String - contextPath: PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.insert_timestamp description: Result insert timestamp. type: String - contextPath: PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results._product description: The result product. type: String - arguments: - description: XDR endpoint ID to run the query on. isArray: true name: endpoint_id - description: Process causality ID to search on the XDR dataset. isArray: true name: process_causality_id required: true - description: Extra fields to add to the query results. isArray: true name: extra_fields - description: 'Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 24 hours.' name: time_frame - description: |- Integer representing the maximum number of results to return. For example: If limit = 100 and the query produced 1,000 results, only the first 100 results will be returned. If limit = 100 and the query produced 50 results, only 50 results will be returned. If limit=5000, 5,000 results are returned. If limit=null or empty (default) up to 100 results are returned. name: limit defaultValue: 100 - description: |- List of strings used for running APIs on local and Managed Security tenants. Valid values: For single tenant (local tenant) query, enter a single-item list with your tenant_id. Additional valid values are, empty list ([]) or null (default). For multi-tenant investigations (Managed Security parent who investigate children and\or local), enter a multi-item list with the required tenant_id. List of IDs can contain the parent, children, or both parent and children. isArray: true name: tenant_id - description: The name of the query. name: query_name required: true - description: Whether to extract more than 1000 query results as JSON data to context instead of returning a .gz file. name: parse_result_file_to_context auto: PREDEFINED predefined: - "true" - "false" defaultValue: "false" description: Search for network connection created by a given process causality ID. polling: true name: xdr-xql-process-causality-network-activity-query outputs: - contextPath: PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.query_name description: The given name of the query. type: String - contextPath: PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.execution_id description: An integer representing a unique ID of a successful XQL query execution. The execution_id value can be passed to the xdr-xql-get-query-results command. type: String - contextPath: PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.status description: |- String representing the status of the API call; SUCCESS, FAIL, or PENDING. For multi-tenant queries, PARTIAL_SUCCESS means that at least one tenant failed to execute the query. Only partial results are available. type: String - contextPath: PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.number_of_results description: Integer representing the number of results returned. type: Number - contextPath: PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.query_cost description: |- Floating number representing the number of query units collected for this API. For example, {"local_tenant_id": 0.01}. For multi-tenant queries, the field displays a value per child tenant. For example, {"tenant_id_1": 0.01, "tenant_id_2": 2.3}. type: Unknown - contextPath: PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.remaining_quota description: Floating number representing the number of query units available for you to use. type: Number - contextPath: PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.agent_hostname description: The agent host name. type: String - contextPath: PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.agent_ip_addresses description: The agent IP addresses. type: String - contextPath: PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.agent_id description: Endpoint ID. type: String - contextPath: PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.action_local_ip description: Local IP address. type: String - contextPath: PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.action_remote_ip description: Remote IP address. type: String - contextPath: PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.action_remote_port description: Remote port. type: String - contextPath: PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.dst_action_external_hostname description: External hostname. type: String - contextPath: PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.dns_query_name description: DNS query name. type: String - contextPath: PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.action_app_id_transitions description: List of application IDs action. Actual activities that took place and recorded by the agent. type: String - contextPath: PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.action_total_download description: Total downloads. type: String - contextPath: PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.action_total_upload description: Total uploads. type: String - contextPath: PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.action_country description: Action country. type: String - contextPath: PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.action_as_data description: The action as data. type: String - contextPath: PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.actor_process_image_sha256 description: The SHA256 value of the initiator. type: String - contextPath: PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.actor_process_image_name description: The name of the process that initiated the activity. type: String - contextPath: PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.actor_process_image_path description: Path of the initiating process. type: String - contextPath: PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.actor_process_signature_vendor description: Initiator signer. type: String - contextPath: PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.actor_process_signature_product description: Initiator product. type: String - contextPath: PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.actor_causality_id description: Causality identifier (CID). type: String - contextPath: PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.actor_process_image_command_line description: Image command line. type: String - contextPath: PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.actor_process_instance_id description: Initiator instance ID. type: String - contextPath: PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results._vendor description: The result vendor. type: String - contextPath: PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results._time description: Result time. type: String - contextPath: PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.insert_timestamp description: Result insert timestamp. type: String - contextPath: PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results._product description: The result product. type: String dockerimage: demisto/python3:3.12.13.10116658 runonce: false script: '-' subtype: python3 type: python marketplaces: - marketplacev2 - platform tests: - XQL Query Engine - Test fromversion: 8.7.0 supportedModules: - xsiam - edr