XQL Commands
getXQLQueryResults
Returns the results of a previously executed XQL query using its execution ID.
Note: This is a polling command.
Arguments
query_id
The execution ID returned when starting an XQL query.
Required
query_name
An optional display label for the query results. When provided, it overrides the server-derived execution name in the output context.
Optional
interval_in_seconds
The polling interval in seconds between each query-status check. Default is 30.
Optional
timeout_in_seconds
The total polling timeout in seconds. Default is 600.
Optional
Outputs
GenericXQLQuery.execution_id string
An integer representing the unique ID of the XQL query execution.
GenericXQLQuery.status string
String representing the status of the Query; SUCCESS, FAIL, or PENDING.
GenericXQLQuery.error_details string
Error information in case of a failed query.
GenericXQLQuery.query_url string
URL to view the complete query results in the Query Center.
GenericXQLQuery.number_of_results number
Integer representing the number of results returned.
GenericXQLQuery.results unknown
The results returned by the query.
GenericXQLQuery.query_limit_modified string
Contains a message if the query's LIMIT clauses were automatically reduced to the maximum supported limit.
GenericXQLQuery.widget_name string
The name of the widget to display the query results.
GenericXQLQuery.widget_description string
A description of the widget associated with the query results.
GenericXQLQuery.query_name string
The name of the query, used for identification purposes.
GenericXQLQuery.timeframe unknown
The timeframe used for the query execution.
GenericXQLQuery.view_def unknown
The view definition data for the query graph.
GenericXQLQuery.graph_data unknown
The graph data for the query visualization.
getXQLQuota
Returns the XQL query quota allocated to and used by the tenant.
Arguments
There are no input arguments for this command.
Outputs
PaloAltoNetworksXQL.Quota.additional_purchased_quota number
Amount of query quota purchased.
PaloAltoNetworksXQL.Quota.current_concurrent_active_queries_count number
Amount of currently active concurrent queries.
PaloAltoNetworksXQL.Quota.daily_used_quota number
Amount of query quota used over the past 24 hours.
PaloAltoNetworksXQL.Quota.eval_quota number
Amount of evaluation query quota.
PaloAltoNetworksXQL.Quota.license_quota number
Amount of daily quota allocated to the tenant based on license type and size.
PaloAltoNetworksXQL.Quota.max_daily_concurrent_active_query_count number
Maximum number of daily concurrent active queries.
PaloAltoNetworksXQL.Quota.total_daily_concurrent_rejected_queries number
Total number of daily concurrent rejected queries.
PaloAltoNetworksXQL.Quota.total_daily_running_queries number
Total number of daily running queries.
PaloAltoNetworksXQL.Quota.used_quota number
Amount of query quota used over the past 24 hours.
runXQLDNSQuery
Query by DNS query or domain name.
Note: This is a polling command.
Arguments
external_domain
A comma-separated list of external domain names to query by.
Optional
dns_query
A comma-separated list of DNS queries to query by.
Optional
endpoint_id
A comma-separated list of endpoint IDs to run the query on. The default is all endpoints.
Optional
extra_fields
A comma-separated list of extra fields to add to the query results.
Optional
query_name
An optional display label for the query results. When provided, it overrides the server-derived execution name in the output context.
Optional
timeframe
Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 7 days. Default is 7 days.
Optional
limit
The maximum number of results to return. Default is 100.
Optional
interval_in_seconds
The polling interval in seconds between each query-status check. Default is 30.
Optional
timeout_in_seconds
The total polling timeout in seconds. Default is 600.
Optional
tenant_id
A comma-separated list of tenant IDs used for running APIs on local and Managed Security tenants. For a single tenant (local tenant) query, provide a single tenant ID; an empty value (default) runs on the local tenant. For multi-tenant investigations (a Managed Security parent investigating children and/or local), provide multiple tenant IDs, which can include the parent, children, or both.
Optional
Outputs
PaloAltoNetworksXQL.DNS.query_name string
The given name of the query.
PaloAltoNetworksXQL.DNS.execution_id string
A unique ID of the XQL query execution.
PaloAltoNetworksXQL.DNS.status string
String representing the status of the query; SUCCESS, FAIL, or PENDING.
PaloAltoNetworksXQL.DNS.number_of_results number
Integer representing the number of results returned.
PaloAltoNetworksXQL.DNS.results.agent_hostname string
The agent host name.
PaloAltoNetworksXQL.DNS.results.agent_ip_addresses unknown
The agent IP addresses.
PaloAltoNetworksXQL.DNS.results.agent_id string
Endpoint ID.
PaloAltoNetworksXQL.DNS.results.agent_os_type string
Host operating system.
PaloAltoNetworksXQL.DNS.results.agent_os_sub_type string
Agent operating system subtype.
PaloAltoNetworksXQL.DNS.results.action_local_ip string
Local IP address.
PaloAltoNetworksXQL.DNS.results.action_remote_ip string
Remote IP address.
PaloAltoNetworksXQL.DNS.results.action_remote_port string
Remote port.
PaloAltoNetworksXQL.DNS.results.dst_action_external_hostname string
External hostname.
PaloAltoNetworksXQL.DNS.results.dns_query_name string
DNS query name.
PaloAltoNetworksXQL.DNS.results.action_app_id_transitions unknown
List of application IDs action. Actual activities that took place and recorded by the agent.
PaloAltoNetworksXQL.DNS.results.action_total_download string
Total downloads.
PaloAltoNetworksXQL.DNS.results.action_total_upload string
Total uploads.
PaloAltoNetworksXQL.DNS.results.action_country string
Action country.
PaloAltoNetworksXQL.DNS.results.action_as_data string
The action as data.
PaloAltoNetworksXQL.DNS.results.os_actor_process_image_path string
Operating system parent path.
PaloAltoNetworksXQL.DNS.results.os_actor_process_command_line string
Command line arguments of the operating system parent.
PaloAltoNetworksXQL.DNS.results.os_actor_process_instance_id string
Initiator instance ID.
PaloAltoNetworksXQL.DNS.results.os_actor_process_causality_id string
Initiator causality ID.
PaloAltoNetworksXQL.DNS.results._vendor string
The result vendor.
PaloAltoNetworksXQL.DNS.results._time string
Result time.
PaloAltoNetworksXQL.DNS.results.insert_timestamp string
Result insert timestamp.
PaloAltoNetworksXQL.DNS.results._product string
The result product.
runXQLDllModuleQuery
Returns DLL module load events filtered by SHA256 module hash using a built-in XQL query.
Note: This is a polling command.
Arguments
loaded_module_sha256
A comma-separated list of SHA256 loaded-module hashes to filter on.
Required
endpoint_id
A comma-separated list of endpoint IDs to run the query on. The default is all endpoints.
Optional
extra_fields
A comma-separated list of extra fields to add to the query results.
Optional
query_name
An optional display label for the query results. When provided, it overrides the server-derived execution name in the output context.
Optional
timeframe
Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 7 days. Default is 7 days.
Optional
limit
The maximum number of results to return. Default is 100.
Optional
interval_in_seconds
The polling interval in seconds between each query-status check. Default is 30.
Optional
timeout_in_seconds
The total polling timeout in seconds. Default is 600.
Optional
tenant_id
A comma-separated list of tenant IDs used for running APIs on local and Managed Security tenants. For a single tenant (local tenant) query, provide a single tenant ID; an empty value (default) runs on the local tenant. For multi-tenant investigations (a Managed Security parent investigating children and/or local), provide multiple tenant IDs, which can include the parent, children, or both.
Optional
Outputs
PaloAltoNetworksXQL.DllModule.execution_id string
An integer representing the unique ID of the XQL query execution.
PaloAltoNetworksXQL.DllModule.status string
String representing the status of the Query; SUCCESS, FAIL, or PENDING.
PaloAltoNetworksXQL.DllModule.error_details string
Error information in case of a failed query.
PaloAltoNetworksXQL.DllModule.query_url string
URL to view the complete query results in the Query Center.
PaloAltoNetworksXQL.DllModule.number_of_results number
Integer representing the number of results returned.
PaloAltoNetworksXQL.DllModule.results unknown
The results returned by the query.
PaloAltoNetworksXQL.DllModule.query_limit_modified string
Contains a message if the query's LIMIT clauses were automatically reduced to the maximum supported limit.
PaloAltoNetworksXQL.DllModule.widget_name string
The name of the widget to display the query results.
PaloAltoNetworksXQL.DllModule.widget_description string
A description of the widget associated with the query results.
PaloAltoNetworksXQL.DllModule.query_name string
The name of the query, used for identification purposes.
PaloAltoNetworksXQL.DllModule.timeframe unknown
The timeframe used for the query execution.
PaloAltoNetworksXQL.DllModule.view_def unknown
The view definition data for the query graph.
PaloAltoNetworksXQL.DllModule.graph_data unknown
The graph data for the query visualization.
runXQLEventLogQuery
Query event logs by event ID.
Note: This is a polling command.
Arguments
event_id
A comma-separated list of numeric event log IDs to search.
Required
endpoint_id
A comma-separated list of endpoint IDs to run the query on. The default is all endpoints.
Optional
extra_fields
A comma-separated list of extra fields to add to the query results.
Optional
query_name
An optional display label for the query results. When provided, it overrides the server-derived execution name in the output context.
Optional
timeframe
Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 7 days. Default is 7 days.
Optional
limit
The maximum number of results to return. Default is 100.
Optional
interval_in_seconds
The polling interval in seconds between each query-status check. Default is 30.
Optional
timeout_in_seconds
The total polling timeout in seconds. Default is 600.
Optional
tenant_id
A comma-separated list of tenant IDs used for running APIs on local and Managed Security tenants. For a single tenant (local tenant) query, provide a single tenant ID; an empty value (default) runs on the local tenant. For multi-tenant investigations (a Managed Security parent investigating children and/or local), provide multiple tenant IDs, which can include the parent, children, or both.
Optional
Outputs
PaloAltoNetworksXQL.EventLog.query_name string
The given name of the query.
PaloAltoNetworksXQL.EventLog.execution_id string
A unique ID of the XQL query execution.
PaloAltoNetworksXQL.EventLog.status string
String representing the status of the query; SUCCESS, FAIL, or PENDING.
PaloAltoNetworksXQL.EventLog.number_of_results number
Integer representing the number of results returned.
PaloAltoNetworksXQL.EventLog.results.agent_hostname string
The agent host name.
PaloAltoNetworksXQL.EventLog.results.agent_ip_addresses unknown
The agent IP addresses.
PaloAltoNetworksXQL.EventLog.results.agent_id string
Endpoint ID.
PaloAltoNetworksXQL.EventLog.results.agent_os_type string
Host operating system.
PaloAltoNetworksXQL.EventLog.results.agent_os_sub_type string
Agent operating system subtype.
PaloAltoNetworksXQL.EventLog.results.action_evtlog_event_id string
Event log ID.
PaloAltoNetworksXQL.EventLog.results.event_type string
Event type.
PaloAltoNetworksXQL.EventLog.results.event_sub_type string
Event subtype.
PaloAltoNetworksXQL.EventLog.results.action_evtlog_message string
Event log message.
PaloAltoNetworksXQL.EventLog.results.action_evtlog_provider_name string
Event log provider name.
PaloAltoNetworksXQL.EventLog.results._vendor string
The result vendor.
PaloAltoNetworksXQL.EventLog.results._time string
Result time.
PaloAltoNetworksXQL.EventLog.results.insert_timestamp string
Result insert timestamp.
PaloAltoNetworksXQL.EventLog.results._product string
The result product.
runXQLFileDropperQuery
Returns file dropper events filtered by file path and/or SHA256 file hash using a built-in XQL query.
Note: This is a polling command.
Arguments
file_path
A comma-separated list of file paths to filter on. At least one of 'file_path' or 'file_sha256' is required.
Optional
file_sha256
A comma-separated list of SHA256 file hashes to filter on. At least one of 'file_path' or 'file_sha256' is required.
Optional
endpoint_id
A comma-separated list of endpoint IDs to run the query on. The default is all endpoints.
Optional
extra_fields
A comma-separated list of extra fields to add to the query results.
Optional
query_name
An optional display label for the query results. When provided, it overrides the server-derived execution name in the output context.
Optional
timeframe
Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 7 days. Default is 7 days.
Optional
limit
The maximum number of results to return. Default is 100.
Optional
interval_in_seconds
The polling interval in seconds between each query-status check. Default is 30.
Optional
timeout_in_seconds
The total polling timeout in seconds. Default is 600.
Optional
tenant_id
A comma-separated list of tenant IDs used for running APIs on local and Managed Security tenants. For a single tenant (local tenant) query, provide a single tenant ID; an empty value (default) runs on the local tenant. For multi-tenant investigations (a Managed Security parent investigating children and/or local), provide multiple tenant IDs, which can include the parent, children, or both.
Optional
Outputs
PaloAltoNetworksXQL.FileDropper.execution_id string
An integer representing the unique ID of the XQL query execution.
PaloAltoNetworksXQL.FileDropper.status string
String representing the status of the Query; SUCCESS, FAIL, or PENDING.
PaloAltoNetworksXQL.FileDropper.error_details string
Error information in case of a failed query.
PaloAltoNetworksXQL.FileDropper.query_url string
URL to view the complete query results in the Query Center.
PaloAltoNetworksXQL.FileDropper.number_of_results number
Integer representing the number of results returned.
PaloAltoNetworksXQL.FileDropper.results unknown
The results returned by the query.
PaloAltoNetworksXQL.FileDropper.query_limit_modified string
Contains a message if the query's LIMIT clauses were automatically reduced to the maximum supported limit.
PaloAltoNetworksXQL.FileDropper.widget_name string
The name of the widget to display the query results.
PaloAltoNetworksXQL.FileDropper.widget_description string
A description of the widget associated with the query results.
PaloAltoNetworksXQL.FileDropper.query_name string
The name of the query, used for identification purposes.
PaloAltoNetworksXQL.FileDropper.timeframe unknown
The timeframe used for the query execution.
PaloAltoNetworksXQL.FileDropper.view_def unknown
The view definition data for the query graph.
PaloAltoNetworksXQL.FileDropper.graph_data unknown
The graph data for the query visualization.
runXQLFileEventQuery
Returns file events filtered by SHA256 file hash using a built-in XQL query.
Note: This is a polling command.
Arguments
file_sha256
A comma-separated list of SHA256 file hashes to filter on.
Required
endpoint_id
A comma-separated list of endpoint IDs to run the query on. The default is all endpoints.
Optional
extra_fields
A comma-separated list of extra fields to add to the query results.
Optional
query_name
An optional display label for the query results. When provided, it overrides the server-derived execution name in the output context.
Optional
timeframe
Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 7 days. Default is 7 days.
Optional
limit
The maximum number of results to return. Default is 100.
Optional
interval_in_seconds
The polling interval in seconds between each query-status check. Default is 30.
Optional
timeout_in_seconds
The total polling timeout in seconds. Default is 600.
Optional
tenant_id
A comma-separated list of tenant IDs used for running APIs on local and Managed Security tenants. For a single tenant (local tenant) query, provide a single tenant ID; an empty value (default) runs on the local tenant. For multi-tenant investigations (a Managed Security parent investigating children and/or local), provide multiple tenant IDs, which can include the parent, children, or both.
Optional
Outputs
PaloAltoNetworksXQL.FileEvent.execution_id string
An integer representing the unique ID of the XQL query execution.
PaloAltoNetworksXQL.FileEvent.status string
String representing the status of the Query; SUCCESS, FAIL, or PENDING.
PaloAltoNetworksXQL.FileEvent.error_details string
Error information in case of a failed query.
PaloAltoNetworksXQL.FileEvent.query_url string
URL to view the complete query results in the Query Center.
PaloAltoNetworksXQL.FileEvent.number_of_results number
Integer representing the number of results returned.
PaloAltoNetworksXQL.FileEvent.results unknown
The results returned by the query.
PaloAltoNetworksXQL.FileEvent.query_limit_modified string
Contains a message if the query's LIMIT clauses were automatically reduced to the maximum supported limit.
PaloAltoNetworksXQL.FileEvent.widget_name string
The name of the widget to display the query results.
PaloAltoNetworksXQL.FileEvent.widget_description string
A description of the widget associated with the query results.
PaloAltoNetworksXQL.FileEvent.query_name string
The name of the query, used for identification purposes.
PaloAltoNetworksXQL.FileEvent.timeframe unknown
The timeframe used for the query execution.
PaloAltoNetworksXQL.FileEvent.view_def unknown
The view definition data for the query graph.
PaloAltoNetworksXQL.FileEvent.graph_data unknown
The graph data for the query visualization.
runXQLNetworkConnectionQuery
Query network connections between a source IP, destination IP and port.
Note: This is a polling command.
Arguments
remote_ip
A comma-separated list of destination IPs of the network connection query.
Required
local_ip
A comma-separated list of source IPs of the network connection query.
Optional
port
A comma-separated list of destination ports of the network connection query.
Optional
endpoint_id
A comma-separated list of endpoint IDs to run the query on. The default is all endpoints.
Optional
extra_fields
A comma-separated list of extra fields to add to the query results.
Optional
query_name
An optional display label for the query results. When provided, it overrides the server-derived execution name in the output context.
Optional
timeframe
Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 7 days. Default is 7 days.
Optional
limit
The maximum number of results to return. Default is 100.
Optional
interval_in_seconds
The polling interval in seconds between each query-status check. Default is 30.
Optional
timeout_in_seconds
The total polling timeout in seconds. Default is 600.
Optional
tenant_id
A comma-separated list of tenant IDs used for running APIs on local and Managed Security tenants. For a single tenant (local tenant) query, provide a single tenant ID; an empty value (default) runs on the local tenant. For multi-tenant investigations (a Managed Security parent investigating children and/or local), provide multiple tenant IDs, which can include the parent, children, or both.
Optional
Outputs
PaloAltoNetworksXQL.NetworkConnection.query_name string
The given name of the query.
PaloAltoNetworksXQL.NetworkConnection.execution_id string
A unique ID of the XQL query execution.
PaloAltoNetworksXQL.NetworkConnection.status string
String representing the status of the query; SUCCESS, FAIL, or PENDING.
PaloAltoNetworksXQL.NetworkConnection.number_of_results number
Integer representing the number of results returned.
PaloAltoNetworksXQL.NetworkConnection.results.agent_hostname string
The agent host name.
PaloAltoNetworksXQL.NetworkConnection.results.agent_ip_addresses unknown
The agent IP addresses.
PaloAltoNetworksXQL.NetworkConnection.results.agent_id string
Endpoint ID.
PaloAltoNetworksXQL.NetworkConnection.results.actor_effective_username string
Parent user name.
PaloAltoNetworksXQL.NetworkConnection.results.action_local_ip string
Local IP address.
PaloAltoNetworksXQL.NetworkConnection.results.action_remote_ip string
Remote IP address.
PaloAltoNetworksXQL.NetworkConnection.results.action_remote_port string
Remote port.
PaloAltoNetworksXQL.NetworkConnection.results.dst_action_external_hostname string
External hostname.
PaloAltoNetworksXQL.NetworkConnection.results.action_country string
Action country.
PaloAltoNetworksXQL.NetworkConnection.results.actor_process_image_name string
The name of the process that initiated the activity.
PaloAltoNetworksXQL.NetworkConnection.results.actor_process_image_path string
Path of the initiating process.
PaloAltoNetworksXQL.NetworkConnection.results.actor_process_command_line string
Command line arguments of the initiator.
PaloAltoNetworksXQL.NetworkConnection.results.actor_process_image_sha256 string
The SHA256 value of the initiator.
PaloAltoNetworksXQL.NetworkConnection.results.actor_process_instance_id string
Initiator instance ID.
PaloAltoNetworksXQL.NetworkConnection.results.actor_process_causality_id string
Initiator causality ID.
PaloAltoNetworksXQL.NetworkConnection.results._vendor string
The result vendor.
PaloAltoNetworksXQL.NetworkConnection.results._time string
Result time.
PaloAltoNetworksXQL.NetworkConnection.results.insert_timestamp string
Result insert timestamp.
PaloAltoNetworksXQL.NetworkConnection.results._product string
The result product.
runXQLProcessCausalityNetworkActivityQuery
Search for network connection created by a given process causality ID.
Note: This is a polling command.
Arguments
process_causality_id
A comma-separated list of process causality IDs to search on the XDR dataset.
Required
endpoint_id
A comma-separated list of endpoint IDs to run the query on. The default is all endpoints.
Optional
extra_fields
A comma-separated list of extra fields to add to the query results.
Optional
query_name
An optional display label for the query results. When provided, it overrides the server-derived execution name in the output context.
Optional
timeframe
Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 7 days. Default is 7 days.
Optional
limit
The maximum number of results to return. Default is 100.
Optional
interval_in_seconds
The polling interval in seconds between each query-status check. Default is 30.
Optional
timeout_in_seconds
The total polling timeout in seconds. Default is 600.
Optional
tenant_id
A comma-separated list of tenant IDs used for running APIs on local and Managed Security tenants. For a single tenant (local tenant) query, provide a single tenant ID; an empty value (default) runs on the local tenant. For multi-tenant investigations (a Managed Security parent investigating children and/or local), provide multiple tenant IDs, which can include the parent, children, or both.
Optional
Outputs
PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.query_name string
The given name of the query.
PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.execution_id string
A unique ID of the XQL query execution.
PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.status string
String representing the status of the query; SUCCESS, FAIL, or PENDING.
PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.number_of_results number
Integer representing the number of results returned.
PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.agent_hostname string
The agent host name.
PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.agent_ip_addresses unknown
The agent IP addresses.
PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.agent_id string
Endpoint ID.
PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.action_local_ip string
Local IP address.
PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.action_remote_ip string
Remote IP address.
PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.action_remote_port string
Remote port.
PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.dst_action_external_hostname string
External hostname.
PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.dns_query_name string
DNS query name.
PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.action_app_id_transitions unknown
List of application IDs action. Actual activities that took place and recorded by the agent.
PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.action_total_download string
Total downloads.
PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.action_total_upload string
Total uploads.
PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.action_country string
Action country.
PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.action_as_data string
The action as data.
PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.actor_process_image_sha256 string
The SHA256 value of the initiator.
PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.actor_process_image_name string
The name of the process that initiated the activity.
PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.actor_process_image_path string
Path of the initiating process.
PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.actor_process_signature_vendor string
Initiator signer.
PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.actor_process_signature_product string
Initiator product.
PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.actor_causality_id string
Causality identifier (CID).
PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.actor_process_image_command_line string
Image command line.
PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.actor_process_instance_id string
Initiator instance ID.
PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results._vendor string
The result vendor.
PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results._time string
Result time.
PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.insert_timestamp string
Result insert timestamp.
PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results._product string
The result product.
runXQLProcessEventQuery
Returns process events filtered by SHA256 process image hash using a built-in XQL query.
Note: This is a polling command.
Arguments
process_sha256
A comma-separated list of SHA256 process image hashes to filter on.
Required
endpoint_id
A comma-separated list of endpoint IDs to run the query on. The default is all endpoints.
Optional
extra_fields
A comma-separated list of extra fields to add to the query results.
Optional
query_name
An optional display label for the query results. When provided, it overrides the server-derived execution name in the output context.
Optional
timeframe
Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 7 days. Default is 7 days.
Optional
limit
The maximum number of results to return. Default is 100.
Optional
interval_in_seconds
The polling interval in seconds between each query-status check. Default is 30.
Optional
timeout_in_seconds
The total polling timeout in seconds. Default is 600.
Optional
tenant_id
A comma-separated list of tenant IDs used for running APIs on local and Managed Security tenants. For a single tenant (local tenant) query, provide a single tenant ID; an empty value (default) runs on the local tenant. For multi-tenant investigations (a Managed Security parent investigating children and/or local), provide multiple tenant IDs, which can include the parent, children, or both.
Optional
Outputs
PaloAltoNetworksXQL.ProcessEvent.execution_id string
An integer representing the unique ID of the XQL query execution.
PaloAltoNetworksXQL.ProcessEvent.status string
String representing the status of the Query; SUCCESS, FAIL, or PENDING.
PaloAltoNetworksXQL.ProcessEvent.error_details string
Error information in case of a failed query.
PaloAltoNetworksXQL.ProcessEvent.query_url string
URL to view the complete query results in the Query Center.
PaloAltoNetworksXQL.ProcessEvent.number_of_results number
Integer representing the number of results returned.
PaloAltoNetworksXQL.ProcessEvent.results unknown
The results returned by the query.
PaloAltoNetworksXQL.ProcessEvent.query_limit_modified string
Contains a message if the query's LIMIT clauses were automatically reduced to the maximum supported limit.
PaloAltoNetworksXQL.ProcessEvent.widget_name string
The name of the widget to display the query results.
PaloAltoNetworksXQL.ProcessEvent.widget_description string
A description of the widget associated with the query results.
PaloAltoNetworksXQL.ProcessEvent.query_name string
The name of the query, used for identification purposes.
PaloAltoNetworksXQL.ProcessEvent.timeframe unknown
The timeframe used for the query execution.
PaloAltoNetworksXQL.ProcessEvent.view_def unknown
The view definition data for the query graph.
PaloAltoNetworksXQL.ProcessEvent.graph_data unknown
The graph data for the query visualization.
runXQLProcessInstanceNetworkActivityQuery
Search for network connection created by a given process instance ID.
Note: This is a polling command.
Arguments
process_instance_id
A comma-separated list of process instance IDs to search on the XDR dataset.
Required
endpoint_id
A comma-separated list of endpoint IDs to run the query on. The default is all endpoints.
Optional
extra_fields
A comma-separated list of extra fields to add to the query results.
Optional
query_name
An optional display label for the query results. When provided, it overrides the server-derived execution name in the output context.
Optional
timeframe
Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 7 days. Default is 7 days.
Optional
limit
The maximum number of results to return. Default is 100.
Optional
interval_in_seconds
The polling interval in seconds between each query-status check. Default is 30.
Optional
timeout_in_seconds
The total polling timeout in seconds. Default is 600.
Optional
tenant_id
A comma-separated list of tenant IDs used for running APIs on local and Managed Security tenants. For a single tenant (local tenant) query, provide a single tenant ID; an empty value (default) runs on the local tenant. For multi-tenant investigations (a Managed Security parent investigating children and/or local), provide multiple tenant IDs, which can include the parent, children, or both.
Optional
Outputs
PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.query_name string
The given name of the query.
PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.execution_id string
A unique ID of the XQL query execution.
PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.status string
String representing the status of the query; SUCCESS, FAIL, or PENDING.
PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.number_of_results number
Integer representing the number of results returned.
PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.agent_hostname string
The agent host name.
PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.agent_ip_addresses unknown
The agent IP addresses.
PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.agent_id string
Endpoint ID.
PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.action_local_ip string
Local IP address.
PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.action_remote_ip string
Remote IP address.
PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.action_remote_port string
Remote port.
PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.dst_action_external_hostname string
External hostname.
PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.dns_query_name string
DNS query name.
PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.action_app_id_transitions unknown
List of application IDs action. Actual activities that took place and recorded by the agent.
PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.action_total_download string
Total downloads.
PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.action_total_upload string
Total uploads.
PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.action_country string
Action country.
PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.action_as_data string
The action as data.
PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.actor_process_image_sha256 string
The SHA256 value of the initiator.
PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.actor_process_image_name string
The name of the process that initiated the activity.
PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.actor_process_image_path string
Path of the initiating process.
PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.actor_process_signature_vendor string
Initiator signer.
PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.actor_process_signature_product string
Initiator product.
PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.actor_causality_id string
Causality identifier (CID).
PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.actor_process_image_command_line string
Image command line.
PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.actor_process_instance_id string
Initiator instance ID.
PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results._vendor string
The result vendor.
PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results._time string
Result time.
PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.insert_timestamp string
Result insert timestamp.
PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results._product string
The result product.
runXQLQuery
Executes an XQL query. Write operations (e.g., queries containing a 'target' clause) are not supported.
Note: This is a polling command.
Arguments
query
The XQL query to execute.
Required
query_name
A name for the query, used to identify it in the results. When omitted, the auto-generated execution name is used.
Optional
widget_name
The name of the widget that will display the query results. Default is XQL Query Results.
Optional
widget_description
A description of the widget associated with the query results. Default is Widget displaying XQL query results.
Optional
timeframe
Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 7 days. Default is 7 days.
Optional
wait_for_results
If true, polls for and returns the full query results. Otherwise, only starts the query and returns the execution ID. Possible values are: true, false. Default is true.
Optional
interval_in_seconds
Interval in seconds between each poll when waiting for results. The default is 2 seconds. Default is 2.
Optional
timeout_in_seconds
Polling timeout in seconds when waiting for results. The default is 180 seconds. Default is 180.
Optional
execution_id
The ID of a previous query execution to fetch results from. If provided, the 'query' and 'timeframe' arguments are ignored.
Optional
Outputs
GenericXQLQuery.execution_id string
An integer representing the unique ID of the XQL query execution.
GenericXQLQuery.status string
String representing the status of the Query; SUCCESS, FAIL, or PENDING.
GenericXQLQuery.error_details string
Error information in case of a failed query.
GenericXQLQuery.query_url string
URL to view the complete query results in the Query Center.
GenericXQLQuery.number_of_results number
Integer representing the number of results returned.
GenericXQLQuery.results unknown
The results returned by the query.
GenericXQLQuery.query_limit_modified string
Contains a message if the query's LIMIT clauses were automatically reduced to the maximum supported limit.
GenericXQLQuery.widget_name string
The name of the widget to display the query results.
GenericXQLQuery.widget_description string
A description of the widget associated with the query results.
GenericXQLQuery.query_name string
The name of the query, used for identification purposes.
GenericXQLQuery.timeframe unknown
The timeframe used for the query execution.
GenericXQLQuery.view_def unknown
The view definition data for the query graph.
GenericXQLQuery.graph_data unknown
The graph data for the query visualization.
runXQLRegistryQuery
Query Windows registry by registry key name.
Note: This is a polling command.
Arguments
reg_key_name
A comma-separated list of registry key names to search.
Required
endpoint_id
A comma-separated list of endpoint IDs to run the query on. The default is all endpoints.
Optional
extra_fields
A comma-separated list of extra fields to add to the query results.
Optional
query_name
An optional display label for the query results. When provided, it overrides the server-derived execution name in the output context.
Optional
timeframe
Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 7 days. Default is 7 days.
Optional
limit
The maximum number of results to return. Default is 100.
Optional
interval_in_seconds
The polling interval in seconds between each query-status check. Default is 30.
Optional
timeout_in_seconds
The total polling timeout in seconds. Default is 600.
Optional
tenant_id
A comma-separated list of tenant IDs used for running APIs on local and Managed Security tenants. For a single tenant (local tenant) query, provide a single tenant ID; an empty value (default) runs on the local tenant. For multi-tenant investigations (a Managed Security parent investigating children and/or local), provide multiple tenant IDs, which can include the parent, children, or both.
Optional
Outputs
PaloAltoNetworksXQL.Registry.query_name string
The given name of the query.
PaloAltoNetworksXQL.Registry.execution_id string
A unique ID of the XQL query execution.
PaloAltoNetworksXQL.Registry.status string
String representing the status of the query; SUCCESS, FAIL, or PENDING.
PaloAltoNetworksXQL.Registry.number_of_results number
Integer representing the number of results returned.
PaloAltoNetworksXQL.Registry.results.agent_hostname string
The agent host name.
PaloAltoNetworksXQL.Registry.results.agent_id string
Endpoint ID.
PaloAltoNetworksXQL.Registry.results.agent_ip_addresses unknown
The agent IP addresses.
PaloAltoNetworksXQL.Registry.results.agent_os_type string
Host operating system.
PaloAltoNetworksXQL.Registry.results.agent_os_sub_type string
Agent operating system subtype.
PaloAltoNetworksXQL.Registry.results.event_type string
Event type.
PaloAltoNetworksXQL.Registry.results.event_sub_type string
Event subtype.
PaloAltoNetworksXQL.Registry.results.action_registry_key_name string
Registry key name.
PaloAltoNetworksXQL.Registry.results.action_registry_value_name string
Registry value name.
PaloAltoNetworksXQL.Registry.results.action_registry_data string
Registry data.
PaloAltoNetworksXQL.Registry.results._vendor string
The result vendor.
PaloAltoNetworksXQL.Registry.results._time string
Result time.
PaloAltoNetworksXQL.Registry.results.insert_timestamp string
Result insert timestamp.
PaloAltoNetworksXQL.Registry.results._product string
The result product.
Last updated
Was this helpful?