Allow Free Form Queries for Cortex XDR

[rc-csmith]

Changes

• Allow users to provide free-form queries (similar to DFE) where the only restriction is that the following fields are present in the output
  • agent_hostname
  • action_process_image_path
  • action_process_username
  • action_process_image_command_line
  • actor_process_image_path
  • actor_primary_username
  • actor_process_command_line
  • event_id
• Create unit tests for Cortex XDR

Closes #111
Closes #112

To Do Items

• Update documentation

[TreWilkinsRC]

Looks like everything is functioning as expected. Highlighting a failure scenario in order to document a potential issue for users who might have set up automated surveys without including a dataset in their query. Approving, but perhaps notify users about this change to ensure they're informed? Apart from that, everything looks good.

Success

--query 'dataset=xdr_data | filter action_process_image_name contains "svchost.exe"'

Full query after processing = 'dataset=xdr_data | filter action_process_image_name contains "svchost.exe" | fields agent_hostname, action_process_image_path, action_process_username, action_process_image_command_line, actor_process_image_path, actor_primary_username, actor_process_command_line, event_id'

-->query: 10 results

Fail

--query '| filter action_process_image_name contains "svchost.exe"'

Full query after processing = ' | filter action_process_image_name contains "svchost.exe" | fields agent_hostname, action_process_image_path, action_process_username, action_process_image_command_line, actor_process_image_path, actor_primary_username, actor_process_command_line, event_id'

Caught HTTPError (see log for details): 500 Server Error: Internal Server Error for url: https://{environment}.[xdr.us.paloaltonetworks.com/public_api/v1/xql/start_xql_query/](http://xdr.us.paloaltonetworks.com/public_api/v1/xql/start_xql_query/)

*All tests were configured to limit the number of results to a maximum of 10.

[rc-csmith]

Sounds good! I'll update the versioning and put out a new release summarizing the recent changes here. I'll also make sure the corresponding wiki is accurate.