Data Analysis With XQL

Which XQL command is used to rename a field in the output results dataset?

When utilizing the 'compact' or 'dedup' commands in an XQL query, an analyst notices that certain fields are missing from the resulting dataset. Why does this behavior occur?

What is the primary purpose of the Cortex Data Model (CDM) in XSIAM?

When reviewing query performance in XSIAM, what does the 'dataset' command do at the beginning of an XQL query?

Which operator is used in XQL filter statements to check if a field value matches any item in a provided list?

An analyst is optimizing a slow-running XQL query in XSIAM. Which TWO best practices should be implemented to improve query performance? (Choose two)

Which TWO components are fundamental parts of every XQL query structure? (Choose two)

Which THREE features are provided by the XQL search query interface in XSIAM to assist analysts during query authoring? (Choose three)

An analyst is investigating a possible data exfiltration incident and needs to build an XQL query that detects a single source IP address making outbound connections to more than 20 distinct destination IP addresses within a 5-minute window. The analyst decides to use the `bin` command to group events into 5-minute buckets. Which command sequence correctly aggregates the data to identify the suspicious source IP?

An analyst notices that a query joining two XQL datasets on a hostname field returns fewer rows than expected. Many hostnames in one dataset appear in uppercase while the other uses lowercase. Which XQL technique should the analyst apply to make the join match consistently?

An analyst investigates a suspected lateral-movement burst and needs to identify source hosts that connected to more than 15 distinct destination IPs within a single hour. The relevant authentication events are already filtered into the pipeline. Which XQL construction produces one row per source host per hour with the distinct destination count?

An analyst wants to examine the distribution of event severities in a dataset and display the count of events for each severity level. Which XQL command should the analyst use?

An analyst is building a query to detect brute-force login attempts. The analyst wants to count failed logins per source IP within each 5-minute window and only surface IPs exceeding 10 failures. Which XQL construct is designed for this time-bucketed aggregation?

A security analyst is investigating a potential data exfiltration incident. They need to identify all unique destination IP addresses that received more than 100 MB of outbound traffic from any internal host during the last 24 hours, and then display the total bytes sent to each of those IPs. The relevant network traffic data is stored in the 'xdr_data' dataset with fields 'action_local_ip', 'action_remote_ip', and 'action_remote_bytes'. Which XQL query correctly produces the required result?

An analyst wants to classify network events into risk buckets based on the numeric field `bytes_out`: under 1 MB is 'low', 1 MB to 100 MB is 'medium', and above 100 MB is 'high'. The classification should be added as a new field in the pipeline without removing existing fields. Which approach accomplishes this in XQL?

An analyst is building an XQL query to detect suspicious PowerShell execution. They want to exclude any command line that contains the string 'Invoke-WebRequest' and also exclude any command line that contains 'DownloadString'. Which XQL filter expression correctly applies both exclusions?

A threat hunter wants to detect beaconing by finding source-destination pairs whose connection count is unusually high within a one-hour window. The analyst groups events by source IP, destination IP, and a one-hour time bucket, then counts connections. Which XQL feature supports creating that one-hour time bucket for grouping?

An analyst is building an XQL query that pulls from a dataset with millions of events and must reduce the volume of data returned to the console while still preserving counts for reporting. Which TWO statements about XQL pipeline behavior are accurate in this scenario? (Choose two.)

An analyst is hunting for encoded PowerShell activity and needs to match command lines containing base64-style strings. The analyst wants a case-insensitive regular expression match against the command_line field. Which XQL filter expression satisfies this?

A threat hunter is analyzing DNS activity in XSIAM using XQL. The hunter wants to identify domains that were queried by more than 50 unique endpoints within the last hour, as this could indicate a broad beaconing or DNS tunneling campaign. The hunter writes a query that groups DNS query events by the queried domain name and counts distinct source endpoints. Which TWO XQL components are required to correctly compute the number of unique endpoints per domain? (Choose two.)

An analyst needs to create an XQL query that enriches network connection events with geographic location data. The analyst has a lookup table named 'ip_geolocation' that maps IP addresses to country codes. The goal is to add a 'country' field to each event based on the destination IP address. Which XQL stage and syntax correctly performs this enrichment?

A threat hunter is analyzing authentication logs in XSIAM using XQL. They want to identify potential brute-force attacks by finding source IP addresses that have more than 10 failed login attempts within a 5-minute window. The logs are in the 'auth_logs' dataset with fields 'src_ip', 'event_time', and 'status' (where 'status' is either 'success' or 'failure'). Which two XQL stages or functions are essential to achieve this? (Choose two.)

An analyst is reviewing XQL query results and notices that the 'actor_process_command_line' field contains long command-line strings that make the output difficult to read. The analyst wants to extract only the first 100 characters of this field into a new field named 'short_cmd' for easier triage. Which XQL stage and function should the analyst use?

A junior analyst is reviewing XQL query results and notices that the 'event_id' field is present in some rows but missing in others. They need to filter the results to only include rows where 'event_id' is not null. Which XQL filter condition should they use?

An analyst is building a query to detect abnormal process behavior. They want to calculate the ratio of network connections to process executions for each process name, but only for processes that have at least 5 executions. The relevant events are in the 'xdr_data' dataset with an 'event_type' field indicating 'process' or 'network'. Which XQL query correctly computes this ratio?

An analyst is building an XQL query to detect brute-force login attempts. The query must count failed login events per source IP within 10-minute windows and then filter for counts exceeding 20. Which two XQL commands or functions are essential to achieve this? (Choose two.)

A security analyst needs to review authentication events from the last 24 hours and display only the username, source IP address, and timestamp. The events are stored in the dataset xdr_data with event_type ENUM.AUTHENTICATION. Which XQL query correctly filters the time range and selects the required fields?

An analyst is investigating a phishing campaign and needs to filter XQL results in the `xdr_data` dataset by a specific set of SHA256 hashes. The hashes are stored in the field `action_file_sha256`. Which XQL filter expression correctly returns only events where the hash matches any value in the provided array?