topic XQL Query help is required to narrow down our requirement in Cortex XDR Discussions

XQL Query help is required to narrow down our requirement

VenuK — Wed, 14 Dec 2022 02:14:36 GMT

Dear All,

We are trying to understand that, there are certain applications installed on a host by using the below query. preset = host_inventory_applications
|filter endpoint_type = "AGENT_TYPE_WORKSTATION"
|filter application_name in("Application A","application B", "Application C")
| comp latest(report_timestamp) by endpoint_name, application_name
| dedup endpoint_name, application_name
| sort asc endpoint_name
| fields endpoint_name, application_name

By running the above query, the result is that, we are getting hostname, application name etc, but we would like to get the result like the below.

Host Name, Applicatioin A, Application B etc, instead of duplicate entries of host with different applications.

Re: XQL Query help is required to narrow down our requirement

bbucao — Wed, 14 Dec 2022 02:45:15 GMT

Hi VenuK,

Try using the values function in the comp stage like in the example below. This will give you a field for each endpoint with an array of the applications

preset = host_inventory_applications
|filter endpoint_type = AGENT_TYPE_WORKSTATION
|filter application_name in("Application A","application B", "Application C")
|comp values(application_name) as installed_applications by endpoint_name

Thanks,
Ben

Re: XQL Query help is required to narrow down our requirement

VenuK — Wed, 14 Dec 2022 02:53:19 GMT

You are really awesome @bbucao , this works