Allow Free Form Queries for Cortex XDR

redcanaryco / surveyor

A cross-platform baselining, threat hunting, and attack surface analysis tool for security teams.

MIT License

169 stars 59 forks source link

Allow Free Form Queries for Cortex XDR #113

Closed rc-csmith closed 1 year ago

rc-csmith commented 1 year ago

Changes

Allow users to provide free-form queries (similar to DFE) where the only restriction is that the following fields are present in the output
- agent_hostname
- action_process_image_path
- action_process_username
- action_process_image_command_line
- actor_process_image_path
- actor_primary_username
- actor_process_command_line
- event_id
Create unit tests for Cortex XDR

Closes #111 Closes #112

To Do Items

Update documentation

rc-csmith commented 1 year ago

Sounds good! I'll update the versioning and put out a new release summarizing the recent changes here. I'll also make sure the corresponding wiki is accurate.