Need to extract installed application.

OsamaKhan — Thu, 30 Sep 2021 16:53:18 GMT

Hi,

I have queries regarding cortex XDR,

Does the cortex xdr provide application inventory counts?

We want to extract each and every application which is installed in all our network systems but with IP.

for e.g, 10.10.10.10 is a system IP, I want to extract how many other applications are installed in this particular IP.

From host insight, we get the list but we want with IP or user.

Re: Need to extract installed application.

malalade — Thu, 30 Sep 2021 22:39:16 GMT

Yes. There are multiple workarounds.
1. You can either use the "Endpoint Administration" Tab to get the equivalent "hostname" of the "IP Address"/"user" and then use "quick Launcher" on the top right to get the "Asset View" of the endpoint
Change the view to applications. That provide the list of application and the count

2. Alternatively, you can use XQL query. Target "Host Inventory" table
Note:

Agent_id is the primary key for the host inventory table. But you can execute the query with a filter such as
- host_name
- ip_addresses
- users
Also, note the timeframe specified because host inventory collection happens daily and you could have multiple counts

With IP Address

dataset = host_inventory
| filter ip_addresses = "10.10.10.10"
| arrayexpand applications
| alter apps = json_extract(applications, "$.application_name")
| fields apps

To make it a re-usable query, change the hardcoded IP Address to "$system_ip" and save it into your query library
Whenever you want to use the query, you will need to supply the target IP Address as the parameter. See attached screenshot

dataset = host_inventory
| filter ip_addresses = "$system_ip"
| arrayexpand applications
| alter apps = json_extract(applications, "$.application_name")
| fields apps

With User name

change the target_user e.g. Smith (case sensitive)

For the count of applications per IP Address

topic Re: Need to extract installed application. in Cortex XDR Discussions

Need to extract installed application.

Re: Need to extract installed application.