topic Using XDR Host Insights and XQL to report of machines with specific software in Cortex XDR Discussions

Using XDR Host Insights and XQL to report of machines with specific software

GarethDavies — Sun, 16 Jan 2022 20:56:54 GMT

Hello All

I would like to use host insights to provide a list of each machine with a specific software installed.

For example computer that have software containing 'docker'

I can go to host insights, Applications, filter to include 'docker' and see the versions and numbers of assets. however you cannot export the lost of each asset here, just the versions and numbers.

I am new to XQL and have not managed to create a query for the host_inventory dataset.

Re: Using XDR Host Insights and XQL to report of machines with specific software

bbarmanroy — Mon, 17 Jan 2022 02:37:51 GMT

Hi @GarethDavies Does the query below aid you?

config case_sensitive = false timeframe=365d 
| dataset = host_inventory 
| filter applications != null
| arrayexpand applications
| alter applications=json_extract(applications, "$.application_name")
| filter applications contains "docker"
|fields applications, ip_addresses, host_name

Re: Using XDR Host Insights and XQL to report of machines with specific software

GarethDavies — Mon, 17 Jan 2022 20:17:59 GMT

Hello Thank you

that solution will work and gives me the raw output that I can investigate further , I see I can add more fields that I may want in the last line

Re: Using XDR Host Insights and XQL to report of machines with specific software

huwang — Wed, 13 Apr 2022 03:28:51 GMT

Hi Bbarmanroy，thank you for sharing. I try to output more fields, such as the application version, but it doesn't work. Look forward to your suggestions.

config case_sensitive = false timeframe=365d
| dataset = host_inventory
| filter applications != null
| arrayexpand applications
| alter applications=json_extract(applications, "$.application_name")
| alter version=json_extract(applications, "$.raw_version")
|fields applications, ip_addresses, host_name, version

Re: Using XDR Host Insights and XQL to report of machines with specific software

bbarmanroy — Wed, 13 Apr 2022 03:59:24 GMT

Hi @huwang use version instead of raw_version.