Skip to content

Add logs to xql query #38097

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 7 commits into from
Jan 13, 2025
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions Packs/ApiModules/ReleaseNotes/2_2_38.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
#### Scripts

##### CoreXQLApiModule

Added logs to the module.
4 changes: 4 additions & 0 deletions Packs/ApiModules/Scripts/CoreXQLApiModule/CoreXQLApiModule.py
Original file line number Diff line number Diff line change
Expand Up @@ -648,6 +648,7 @@ def start_xql_query_polling_command(client: CoreClient, args: dict) -> Union[Com
raise DemistoException('Please provide a query name')
execution_id = start_xql_query(client, args)
if execution_id == 'FAILURE':
demisto.debug("Did not succeed to start query, retrying.")
# the 'start_xql_query' function failed because it reached the maximum allowed number of parallel running queries.
# running the command again using polling with an interval of 'interval_in_secs' seconds.
command_results = CommandResults()
Expand All @@ -661,6 +662,7 @@ def start_xql_query_polling_command(client: CoreClient, args: dict) -> Union[Com

if not execution_id:
raise DemistoException('Failed to start query\n')
demisto.debug(f"Succeeded to start query with {execution_id=}.")
args['query_id'] = execution_id
args['command_name'] = demisto.command()

Expand Down Expand Up @@ -703,12 +705,14 @@ def get_xql_query_results_polling_command(client: CoreClient, args: dict) -> Uni

# if status is pending, the command will be called again in the next run until success.
if outputs.get('status') == 'PENDING':
demisto.debug(f"Returned status 'PENDING' for {args.get('query_id', '')}.")
scheduled_command = ScheduledCommand(command='xdr-xql-get-query-results', next_run_in_seconds=interval_in_secs,
args=args, timeout_in_seconds=600)
command_results.scheduled_command = scheduled_command
command_results.readable_output = 'Query is still running, it may take a little while...'
return command_results

demisto.debug(f"Returned status '{outputs.get('status')}' for {args.get('query_id', '')}.")
results_to_format = outputs.pop('results')
# create Human Readable output
query = args.get('query', '')
Expand Down
2 changes: 1 addition & 1 deletion Packs/ApiModules/pack_metadata.json
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"name": "ApiModules",
"description": "API Modules",
"support": "xsoar",
"currentVersion": "2.2.37",
"currentVersion": "2.2.38",
"author": "Cortex XSOAR",
"url": "https://www.paloaltonetworks.com/cortex",
"email": "",
Expand Down
6 changes: 6 additions & 0 deletions Packs/Core/ReleaseNotes/3_2_19.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@

#### Integrations

##### XQL Query Engine

Documentation and metadata improvements.
2 changes: 1 addition & 1 deletion Packs/Core/pack_metadata.json
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"name": "Core - Investigation and Response",
"description": "Automates incident response",
"support": "xsoar",
"currentVersion": "3.2.18",
"currentVersion": "3.2.19",
"author": "Cortex XSOAR",
"url": "https://www.paloaltonetworks.com/cortex",
"email": "",
Expand Down
6 changes: 6 additions & 0 deletions Packs/CortexXDR/ReleaseNotes/6_2_6.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@

#### Integrations

##### Cortex XDR - XQL Query Engine

Documentation and metadata improvements.
2 changes: 1 addition & 1 deletion Packs/CortexXDR/pack_metadata.json
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"name": "Cortex XDR by Palo Alto Networks",
"description": "Automates Cortex XDR incident response, and includes custom Cortex XDR incident views and layouts to aid analyst investigations.",
"support": "xsoar",
"currentVersion": "6.2.5",
"currentVersion": "6.2.6",
"author": "Cortex XSOAR",
"url": "https://www.paloaltonetworks.com/cortex",
"email": "",
Expand Down
Loading