[FR] Cortex Free-Form Query

[rc-csmith]

Which category is the feature part of?

• [ ] Definition File
• [x] Code/Logic Feature
• [ ] Other (please explain)

Which product is the feature part of?

• [ ] All Products
• [ ] Carbon Black Response
• [ ] Carbon Black Threat Hunter
• [ ] Defender for Endpoints
• [ ] SentinelOne
• [x] Cortex
• [ ] Other

Use Cases

Proposal

Cortex can contain more than just the xdr_data dataset. Users should be able to define the table they want to query when using the --query option or query field in a definition file.

Additional Context

N/A