Correlation Rules and XQL Queries for Cortex XDR and Cortex XSIAM

This repository contains samples of correlation rules and XQL queries that can be leveraged in Cortex XDR and/or Cortex XSIAM. These queries may have dependencies which will be explained.

Summary

• Summary
• Getting Started
• Support
• Contributing
• Maintainers
• Acknowledgments

Getting Started

Correlation rules can be copied from this repository and inserted into your query builder by navigating to your tenant and browsing to Detection & Threat Intel > Detection Rules > Correlations.

When creating correlation rules, be sure to follow the recommendations for the Alert Fields Mapping.

XQL queries can be copied from this repository and inserted into your query builder by navigating to your tenant and browsing to Incident Response > Investigation > Query Builder.

Support

Please read SUPPORT.md for details on how to get support for this project.

Contributing

We value your contributions! Please read CONTRIBUTING.md for details on how to contribute, and the process for submitting pull requests to us.

Maintainers

• Kevin Mastin - (Account link coming soon)
• Ami Tsarfati - (Account link coming soon)
• Maor Hojberg - (Account link coming soon)
• David Soshany - (Account link coming soon)
• Netanel Simchon - (Account link coming soon)
• Eric Boerger - (Account link coming soon)
• Joel Ebrihimi - (Account link coming soon)
• Ron Collins - (Account link coming soon)
• Raymond DePalma - radepalma
• David Falcon - dfalconpanw
• Mark DeDominic - (Account link coming soon)

Thank you to all the contributors who participated in this project.

Acknowledgments