Cortex XDR XQL join() stage combines the results of two queries into a single result set.
join conflict_strategy = both|left|right type = inner|left|right (<xql query>) as <execution_name> <boolean_expr>)
join()stage combines the results of two queries into a single result set. This stage is conceptually identical to a SQL join.
Identifies the join conflict strategy.
Identifies the join type.
Provides the XQL query to be joined with the parent query.
Provides an alias for the join query's result set. For example, if you specify an execution name of
join1, and in the join query you return field
agent_id, then you can subsequently refer to that field as
Identifies the conditions that must be met in order to place a record in the join result set.
Recommended For You
Recommended videos not found.