topic Re: Query for listing installed VPN's in organization in Cortex XDR Discussions

Query for listing installed VPN's in organization

DragomirGaliaIT — Tue, 16 May 2023 04:59:02 GMT

Hey everyone,

I'm trying to list all devices within organization that have installed some VPN on them, but my query fails each time or returns small number of results. I set it to have most popular 10 VPN's in the list like Nord, OpenVPN, Express, Cyber Ghost etc.

Could you please help me out in adjusting query, to list hostname of the devices and the installed VPN:

dataset = xdr_data
| filter actor_process_image_name in(" *VPN*, ")
| comp
values(actor_process_image_path ) by agent_hostname, actor_effective_username

Re: Query for listing installed VPN's in organization

bbucao — Wed, 17 May 2023 13:33:57 GMT

Hi DragomirGaliaIT,

The query example you listed has some slight syntax errors. To search for for a match on the process name using the "in" operator, make sure you have each value in quotes and separated by a coma as shown below. Another suggestion would be using the digital signer field and searching for these VPN's digital signer for a more thorough search.

dataset = xdr_data
| filter actor_process_image_name in("*nord*", "*express*")
| comp
values(actor_process_image_path ) by agent_hostname, actor_effective_username

Thanks,
Ben