File lookup

VineethArumulla — Thu, 02 Feb 2023 10:48:44 GMT

Is it possible to check if a file is present on any system in network through Cortex XDR based on file name or the hash value of the file.

Re: File lookup

neelrohit — Thu, 02 Feb 2023 13:22:12 GMT

Hi @VineethArumulla ,

Thank you for writing to live community!

As I understand you intend to lookup for presence of files or hashes in the endpoints using Cortex XDR. This is possible using the host insights "File Search" feature. If you have Cortex XDR Pro Per Endpoints license and Host-Insights add-on license, then you need to enable "Host Insights Capabilities".

If this enabled, then you can search for files by file paths or file hashes under the "Action Center" items. Select the file path with(or without) wildcards. You should be able to find the details for the same.

Alternatively, if you do not have the add-on license, then you can query for file names using Cortex XDR query builder. This would only happen provided if the file activity has been reported by Cortex XDR.

Hope this helps!

topic Re: File lookup in Cortex XDR Discussions

File lookup

Re: File lookup