Call

Cortex XDR XQL call stage is used to reference a predefined query from the Query Library.

Synopsis

call "<
name of predefined query
>"

Description

The
call
stage is used to reference a predefined query from the Query Library, including your Personal Query Library.

Example

For the predefined query called "CreateRole operation parsed to fields", returns a maximum of 100 records, where the accessKeyId equals "1234".
call "CreateRole operation parsed to fields" | filter accessKeyId = "1234" | limit 100

Recommended For You