File search based on Host

Shashanksinha — Mon, 20 Mar 2023 15:56:50 GMT

Is there any option in Cortex XDR, where we can check which all hosts have a specific exe present?

For eg We want to get a list of hosts which has google chrome installed in it.

Regards,

Shashank

Re: File search based on Host

timurphy — Mon, 20 Mar 2023 16:13:55 GMT

Hi @Shashanksinha,

Both use cases in your question can be addressed via features included with the Host Insights add-on.

You can search for a specific file hash or file path across your target endpoints using the File Search action within the Action Center (Incident Response > Response > Action Center > New Action > File Search).

If you are looking for installed software such as Google Chrome, you could review the Host Inventory (Incident Response > Investigation > Host Inventory > Applications). There is also a preset called host_inventory_applications which you can run custom queries against using XQL.

I hope this helps!

Regards,

Tim

topic Re: File search based on Host in Cortex XDR Discussions

File search based on Host

Re: File search based on Host