Cortex XDR XQL current_time() function returns the current time as a timestamp.
current_time()function returns a timestamp value representing the current time in the format MMM dd YYYY HH:mm:ss, such as Jul 12th 2021 20:51:34.
From the xdr_data dataset, returns the events of the last 24 hours whose actor process started running more than 30 days ago.
dataset = xdr_data | filter timestamp_diff(current_time(),to_timestamp(actor_process_execution_time, "MILLIS"), "DAY") > 30
Recommended For You
Recommended videos not found.