XQL Query to list top process causing issues

VenuK — Tue, 24 Jan 2023 06:01:55 GMT

Dear All,

I would like to know how to build a query to troubleshoot issues on a host where I wanted to list the processes running on the host and also to identify which is causing the issue. I am writing the below query to find no details, please help.

preset = xdr_process
| filter agent_hostname contains "Host1" or agent_hostname contains "Host2"

Thank you all in advance.

Re: XQL Query to list top process causing issues

etugriceri — Mon, 30 Jan 2023 11:34:29 GMT

Hi @VenuK

You should consider XQL queries is like event based queries.

If process start and stops, You'll have an event data and that data 'll be queriable by XQL.

But you cannot get current status with XQL.(like which process is actively working)

Potentially, Still you can write a heavy query and get all executed process in last 24 hours and if process has not ended you can list but what if process executed more than 24 hours a go ?

Best way to get that data is using "Action Center" > "Run Endpoint Script" > "Process get"

This script'll list active processes which is working on the endpoints.

topic Re: XQL Query to list top process causing issues in Cortex XDR Discussions

XQL Query to list top process causing issues

Re: XQL Query to list top process causing issues