capabilities.work

Cortex XDR XQL Threat Hunt

A 2-step recipe with Palo Alto Networks. We can help you get access.

Recipe · 2 steps

Cortex XDR XQL Threat Hunt

with Palo Alto Networks

Execute an XQL query and retrieve its results once complete.

  1. Initiate the XQL query over the supplied timeframe and capture the query id.
  2. Retrieve the query results. Repeat while the query is still pending, and end once the status is SUCCESS, FAILED, or CANCELED.
What you'll need to have ready
  • query: XQL query string to execute against the Cortex XDR data lake.
  • relativeTime: Relative time range for the query (e.g. last_24_hours, last_7_days).
  • maxResults: Maximum number of result rows to return.
For your developer

Arazzo workflow palo-alto-networks:run-xql-query, 2 operations: startXqlQuery → getXqlQueryResults. Specs on APIs.io.

More recipes with Palo Alto Networks

Cortex XDR Endpoint Isolation and VerificationCortex XDR Incident Triage and ResolutionCortex XDR Script Remediation with Result PollingCortex XSIAM Incident-Driven Asset and XQL HuntCortex XSOAR Incident Response OrchestrationIoT Security Alert Investigation and ResolutionIoT Security Device Risk and Policy RecommendationPrisma Cloud Alert Triage and DismissalPrisma Cloud Policy Review and UpdatePrisma Cloud RQL Configuration and Asset Search