topic Re: Need help with XQL query to report deleted files in Cortex XDR Discussions

Need help with XQL query to report deleted files

chinsiongwong — Wed, 05 Jul 2023 01:02:45 GMT

Dear Sir,

Please if anyone can help to advise the XQL query to create a custom report to capture the "File Delete" activities in one particular server?

I know we can create the same from Query Builder, but from Query Builder it will only return 10,000 records. In addition, we not able to email the result as attachment (or if i am wrong with this understanding?).

Any help and advise is very appreciated.

Regards,

Re: Need help with XQL query to report deleted files

eluis — Wed, 05 Jul 2023 11:11:08 GMT

Hi @chinsiongwong

thanks for writing us in LiveCommunity.

Please try the following XQL query

dataset =xdr_data | filter event_type = ENUM.FILE and event_sub_type = FILE_REMOVE and agent_hostname_here = "your_server_hostname " | fields agent_hostname, agent_version, action_file_path , event_sub_type, event_type | dedup action_file_path | limit 1000

. Please notice that: You can use this query and save it as a widget and save the results as csv file which can be exported in from of reports

The limit = 1000 will limit your results. If results are bigger than 20MB you wont be able to export them.

Replace your_server_hostname by the name of your server you want to monitor

Please granularity your reports as much as you can/want

I hope this helps. Mark this as a solution if it helps

KR,

Luis

Re: Need help with XQL query to report deleted files

chinsiongwong — Thu, 06 Jul 2023 09:20:12 GMT

Dear Eluis,

One more question - please can we further filter the query by ext, for example "doc", "docx", "ppt". "pptx", etc etc?

Thank you very much

Re: Need help with XQL query to report deleted files

chinsiongwong — Fri, 07 Jul 2023 07:01:08 GMT

Please ignore this. Got it works.

Thank you very much.