An analyst wants to parse a custom log string field containing key-value pairs separated by spaces into distinct XQL fields. Which command should be used?
An analyst wants to count the number of unique IP addresses communicating with external networks in an XQL query. Which command combination accomplishes this efficiently?
An analyst needs to query all endpoint events in XQL where the action type is explicitly equal to 'PROCESS_START'. Which XQL syntax correctly applies this filter?
An analyst is grouping events by user and calculating the average CPU utilization. Which XQL aggregate function should be used inside the 'stats' command?
An analyst wants to write an XQL query that utilizes a lookup table called 'threat_ips' to tag events where the source IP matches a known malicious IP. Which command sequence is correct?
An analyst writes an XQL query using the 'sliding window' or sequence correlation features to detect a failed login followed by a successful login within 5 minutes. Which command structure facilitates event sequencing in XQL?
An analyst wants to output distinct values of a field while also showing a count of occurrences for each. Which XQL aggregation pattern is best suited for this?
An analyst wants to extract a substring from a file path using a regular expression and store it in a new field. Which XQL function accomplishes this inside an 'alter' command?
An analyst wants to calculate the time difference between two events (process creation and network connection) for the same process GUID. Which XQL function calculates the time delta?
An analyst needs to transform an IP address field into an integer representation within an XQL query using the 'alter' command. Which function should be used?
An analyst wants to ensure that string comparisons in an XQL filter are case-insensitive. Which TWO methods or operators can achieve this? (Choose two)
An analyst is investigating authentication logs and needs to filter events based on multiple status codes (e.g., 401, 403, 500). Which TWO valid XQL filter constructions can accomplish this? (Choose two)
An analyst wants to reshape query results to display statistical summaries. Which TWO commands are commonly used for data aggregation and shaping in XQL? (Choose two)
A security analyst is building a correlation rule in XSIAM that requires enriching incoming firewall logs with asset criticality information stored in a lookup table named `asset_inventory`. The lookup table has columns `ip_address` and `criticality`. The analyst wants to add the `criticality` field to each event where the source IP matches an entry in the lookup table. Which XQL command should be used to perform this enrichment?
An analyst is investigating lateral movement and wants to identify the first time each source host was seen communicating with a suspicious destination over the last 30 days. The dataset contains millions of events. Which XQL approach most efficiently returns one row per source host showing its earliest connection timestamp?
An analyst is investigating a series of failed login attempts and wants to identify users who have experienced more than 10 failed logins from different source IP addresses within the last hour. The analyst writes an XQL query but needs to ensure that only users with a high number of distinct source IPs are returned. Which XQL function should be used in the `stats` command to count the distinct source IPs per user?
An analyst is investigating a suspected data-exfiltration incident and needs to identify internal hosts that transferred more than 500 MB to external IP addresses during a 24-hour window. The relevant events reside in the `xdr_data` dataset, which contains the fields `action_local_ip`, `action_remote_ip`, `action_external`, and `bytes_sent`. Which XQL query correctly produces the list of internal hosts exceeding the threshold?
An analyst needs to build a scheduled XQL query that flags any process execution where a parent process named 'winword.exe' spawned a child process, but only when the two events occur within 30 seconds of each other on the same endpoint. The analyst wants to correlate parent and child events without relying on a pre-existing causality field. Which XQL capability should the analyst use to pair these events based on time proximity and a shared endpoint identifier?
An analyst is reviewing endpoint telemetry and wants to see the very first time each unique process name appeared in the last 24 hours, along with the host it ran on. Which XQL construct best produces one row per process name showing its earliest event?
During an investigation an analyst must correlate a process execution event with the network connection it spawned, but the two record types live in different datasets and share no common field name; the process GUID exists in one dataset and the parent process GUID in the other. Which XQL join form lets the analyst match these records while preserving all execution events even when no matching connection exists?
An analyst is building a complex XQL query to analyze network traffic. The query must filter events to include only those where the `action` field is either 'ALLOW' or 'DENY', and the `bytes_out` field is greater than 1000. The analyst also wants to exclude events where the `user` field is 'admin'. Which two XQL filter expressions correctly implement these conditions? (Choose two.)
An analyst is investigating a suspected data-staging activity on a Windows endpoint. They want to find all process execution events from the 'xdr_data' dataset where the process name ends with 'rar.exe' and the command line contains the string 'a -ep'. The query must return only matching events without any aggregation. Which XQL filter condition achieves this?
An analyst is investigating a suspected lateral movement incident and needs to examine authentication events that occurred within a specific 15-minute window on a particular endpoint. The analyst wants to filter events from the xdr_data dataset where the event timestamp falls between 2024-03-15 14:00:00 and 2024-03-15 14:15:00, and the agent hostname equals 'FIN-WS-042'. Which XQL query correctly applies these conditions?
A security analyst needs to correlate DNS query events with process execution events to identify processes that resolved suspicious domains. The DNS events are in the `dns_events` dataset with fields `hostname`, `query_name`, and `_time`. The process events are in the `xdr_data` dataset with fields `agent_hostname`, `process_name`, and `_time`. The analyst wants to join these datasets on the hostname field, matching events where the DNS query occurred within 5 minutes before the process execution. Which XQL join approach correctly achieves this?
A security analyst is building an XQL query to identify rare process executions on endpoints. The analyst wants to count how many times each process name appears across all endpoints in the last 24 hours, then display only processes that executed fewer than 5 times. The query should show the process name and its execution count, sorted from least to most frequent. Which XQL query achieves this?
An analyst wants to review only the fields that matter for a phishing triage dashboard and must rename a field called 'email_subject' to 'subject_line' so the dashboard widget binds correctly. Which XQL stage accomplishes the rename while keeping the rest of the pipeline intact?
A security analyst is examining authentication logs in the 'auth_data' dataset. They need to identify source IP addresses that have more than 10 failed login attempts within a 5-minute window. The query should group events into 5-minute buckets based on the event timestamp and count failures per IP per bucket. Which XQL pipeline correctly achieves this?
An analyst needs to write an XQL query that extracts the domain portion from a field named 'url' and then counts how many events are associated with each domain. The 'url' field contains values like 'https://www.example.com/path?query=1'. Which XQL query accomplishes this?
A junior analyst is reviewing an XQL query that uses the `fields` command to select specific columns from a dataset. The analyst wants to include the `event_id`, `timestamp`, and `description` fields in the output, but also wants to rename `description` to `event_description` in the results. Which XQL command should be used to achieve this?
During an investigation an analyst needs to combine process execution events with their corresponding network connection events, matching on both the endpoint hostname and the process identifier, and wants only pairs that exist in both datasets. Which XQL approach is correct?
An analyst needs to enrich XSIAM event data with external threat intelligence. They want to use an XQL query to check if any source IP in the 'xdr_data' dataset appears in a threat intelligence feed stored as a lookup table named 'threat_feed'. The lookup table contains a field 'ip_address' with known malicious IPs. Which two XQL approaches correctly perform this enrichment? (Choose two.)
An analyst is reviewing a dataset of endpoint process events in XSIAM. They need to produce a result set that shows, for each unique combination of process name and parent process name, the total number of events and the earliest timestamp observed. Which XQL query structure accomplishes this goal?
An analyst needs to extract the top-level domain from a field named `url` in the `xdr_data` dataset. The `url` field contains full URLs such as `https://www.example.com/path/page.html`. Which XQL function and syntax correctly extracts `example.com`?
An analyst needs to parse a field named `raw_log` that contains JSON-formatted strings, such as `{"user":"admin","action":"login","status":"success"}`. The analyst wants to extract the value of the `user` key into a new field called `username`. Which XQL function and syntax correctly achieves this?
An analyst is building an XQL query to detect suspicious network activity. They need to extract the top-level domain from a fully qualified domain name (FQDN) stored in the field dns_query_name, and then filter for domains that are not in a known benign list. Which TWO actions must the analyst perform within the XQL query to achieve this? (Choose two.)
A security analyst is building an XQL query to detect potential data exfiltration by correlating process execution with network activity. They need to join two datasets: `xdr_data` (process events) and `network_data` (network connection events) on the `agent_id` field. Which TWO statements accurately describe the behavior or requirements of the `join` command in XQL? (Choose two.)
A junior analyst needs to calculate the total number of events per hour from the `xdr_data` dataset to identify peak activity periods. Which XQL query correctly groups events by hour and returns the count for each hour?
When utilizing the 'compact' or 'dedup' commands in an XQL query, an analyst notices that certain fields are missing from the resulting dataset. Why does this behavior occur?
An analyst is investigating a possible data exfiltration incident and needs to build an XQL query that detects a single source IP address making outbound connections to more than 20 distinct destination IP addresses within a 5-minute window. The analyst decides to use the `bin` command to group events into 5-minute buckets. Which command sequence correctly aggregates the data to identify the suspicious source IP?
An analyst notices that a query joining two XQL datasets on a hostname field returns fewer rows than expected. Many hostnames in one dataset appear in uppercase while the other uses lowercase. Which XQL technique should the analyst apply to make the join match consistently?
An analyst investigates a suspected lateral-movement burst and needs to identify source hosts that connected to more than 15 distinct destination IPs within a single hour. The relevant authentication events are already filtered into the pipeline. Which XQL construction produces one row per source host per hour with the distinct destination count?
An analyst wants to examine the distribution of event severities in a dataset and display the count of events for each severity level. Which XQL command should the analyst use?
An analyst is building a query to detect brute-force login attempts. The analyst wants to count failed logins per source IP within each 5-minute window and only surface IPs exceeding 10 failures. Which XQL construct is designed for this time-bucketed aggregation?
A security analyst is investigating a potential data exfiltration incident. They need to identify all unique destination IP addresses that received more than 100 MB of outbound traffic from any internal host during the last 24 hours, and then display the total bytes sent to each of those IPs. The relevant network traffic data is stored in the 'xdr_data' dataset with fields 'action_local_ip', 'action_remote_ip', and 'action_remote_bytes'. Which XQL query correctly produces the required result?
An analyst wants to classify network events into risk buckets based on the numeric field `bytes_out`: under 1 MB is 'low', 1 MB to 100 MB is 'medium', and above 100 MB is 'high'. The classification should be added as a new field in the pipeline without removing existing fields. Which approach accomplishes this in XQL?
An analyst is building an XQL query to detect suspicious PowerShell execution. They want to exclude any command line that contains the string 'Invoke-WebRequest' and also exclude any command line that contains 'DownloadString'. Which XQL filter expression correctly applies both exclusions?
A threat hunter wants to detect beaconing by finding source-destination pairs whose connection count is unusually high within a one-hour window. The analyst groups events by source IP, destination IP, and a one-hour time bucket, then counts connections. Which XQL feature supports creating that one-hour time bucket for grouping?
An analyst is building an XQL query that pulls from a dataset with millions of events and must reduce the volume of data returned to the console while still preserving counts for reporting. Which TWO statements about XQL pipeline behavior are accurate in this scenario? (Choose two.)
An analyst is hunting for encoded PowerShell activity and needs to match command lines containing base64-style strings. The analyst wants a case-insensitive regular expression match against the command_line field. Which XQL filter expression satisfies this?
A threat hunter is analyzing DNS activity in XSIAM using XQL. The hunter wants to identify domains that were queried by more than 50 unique endpoints within the last hour, as this could indicate a broad beaconing or DNS tunneling campaign. The hunter writes a query that groups DNS query events by the queried domain name and counts distinct source endpoints. Which TWO XQL components are required to correctly compute the number of unique endpoints per domain? (Choose two.)
An analyst needs to create an XQL query that enriches network connection events with geographic location data. The analyst has a lookup table named 'ip_geolocation' that maps IP addresses to country codes. The goal is to add a 'country' field to each event based on the destination IP address. Which XQL stage and syntax correctly performs this enrichment?
A threat hunter is analyzing authentication logs in XSIAM using XQL. They want to identify potential brute-force attacks by finding source IP addresses that have more than 10 failed login attempts within a 5-minute window. The logs are in the 'auth_logs' dataset with fields 'src_ip', 'event_time', and 'status' (where 'status' is either 'success' or 'failure'). Which two XQL stages or functions are essential to achieve this? (Choose two.)
An analyst is reviewing XQL query results and notices that the 'actor_process_command_line' field contains long command-line strings that make the output difficult to read. The analyst wants to extract only the first 100 characters of this field into a new field named 'short_cmd' for easier triage. Which XQL stage and function should the analyst use?
A junior analyst is reviewing XQL query results and notices that the 'event_id' field is present in some rows but missing in others. They need to filter the results to only include rows where 'event_id' is not null. Which XQL filter condition should they use?
An analyst is building a query to detect abnormal process behavior. They want to calculate the ratio of network connections to process executions for each process name, but only for processes that have at least 5 executions. The relevant events are in the 'xdr_data' dataset with an 'event_type' field indicating 'process' or 'network'. Which XQL query correctly computes this ratio?
An analyst is building an XQL query to detect brute-force login attempts. The query must count failed login events per source IP within 10-minute windows and then filter for counts exceeding 20. Which two XQL commands or functions are essential to achieve this? (Choose two.)
A security analyst needs to review authentication events from the last 24 hours and display only the username, source IP address, and timestamp. The events are stored in the dataset xdr_data with event_type ENUM.AUTHENTICATION. Which XQL query correctly filters the time range and selects the required fields?
An analyst is investigating a phishing campaign and needs to filter XQL results in the `xdr_data` dataset by a specific set of SHA256 hashes. The hashes are stored in the field `action_file_sha256`. Which XQL filter expression correctly returns only events where the hash matches any value in the provided array?