topic Re: Searching for multiple hashes on cortex XDR in Cortex XDR Discussions

Searching for multiple hashes on cortex XDR

rufat87 — Thu, 23 Mar 2023 14:57:43 GMT

Does anyone know a way to search for multiple hashes on Cortex XDR?

file_search = existing_files does not allow any operators other than "=" for the sha values and you can't string multiple in a query.

I feel like I'm missing something and there should be a way to do that that I'm not aware of.

Any ideas?

Re: Searching for multiple hashes on cortex XDR

anlynch — Thu, 23 Mar 2023 16:49:54 GMT

Hey @rufat87,

Thanks for reaching out on LIVEcommunity!

It appears you're looking for a field you can use the "in" operator with. Use of the "in" operators looks like this

dataset = xdr_data | filter action_file_sha256 in ("4138198e8b807e106ad7c256bfe9bd4e9d9a2de3473367405bc3c299cc774294", "f491caeb1a1b561b0d87efcb17deb79e63eb993940a6d34346dea6504f7c9400") | fields _time, action_file_name

Alternatively, you have the option of using the query builder and using a pipe ( | ) to separate multiple values in any field.

A display of the results is below (I used dummy hash values so there are no results, I wanted to draw your attention to the query itself).

I hope this information helps. For future reference I'll provide you with a great XQL resource.

If you have any other questions or if I didn't answer your question fully please feel free to respond here.

Have a great day!

Re: Searching for multiple hashes on cortex XDR

rufat87 — Thu, 23 Mar 2023 17:01:48 GMT

Thanks for responding, I was aware of such file search. I was hoping a search against files existing on the hosts via sha would also have an option of multiple value input. I guess you are saying that is not possible for file_search = existing_files xql query?

Re: Searching for multiple hashes on cortex XDR

VidRupnik — Wed, 31 May 2023 11:51:02 GMT

Since this question is still open to discussion, I have the similar question... is it possible to build such a query to search across multiple hashes from external data files GitHub, etc.? MS example that kind of query search:
| where SHA1 in (externaldata(hash:string)[URL])... thanks for any info. on that.