Logs not visible - XQL Query

Aiman_Fathima — Tue, 03 Jan 2023 08:43:58 GMT

Hello,

Currently we are trying to create a query that gives us the result if the user has executed Sudo command and then right after executed the cd command. Is it possible to write a query that searches for commands executed one after the other?

During this process we observed that cortex is not giving us logs for cd command in any of the systems. why is it so?

Re: Logs not visible - XQL Query

etugriceri — Tue, 03 Jan 2023 09:52:49 GMT

Hi @Aiman_Fathima

You can use below query. You should have enough telemetry data for this task, if you enabled XDR Pro on the endpoint.

dataset = xdr_data
| filter os_actor_process_image_path = "/usr/bin/sudo" and os_actor_process_command_line contains "cd"

topic Logs not visible - XQL Query in Cortex XDR Discussions

Logs not visible - XQL Query

Re: Logs not visible - XQL Query