topic Re: XQL - list of processes, which were not started/launched in the last XX days in Cortex XDR Discussions

XQL - list of processes, which were not started/launched in the last XX days

RFeyertag — Mon, 14 Aug 2023 21:24:53 GMT

Hello dear community,

I would like to have a list of processes which were not started/launched in the past XX days. I think it would be nice to know, which processes are brand new etc.

Will this work with XQL and how?

Rob

Re: XQL - list of processes, which were not started/launched in the last XX days

mavega — Tue, 15 Aug 2023 18:56:35 GMT

Hi RFeyertag,

Thanks for reaching out to our live community.

We are looking into your inquiry and doing some research to provide you with the best possible response.

Could you please elaborate a bit more? What is the use case for your inquiry?

Please provide as many details as possible as there might a better approach on gathering the information you are looking for.

Re: XQL - list of processes, which were not started/launched in the last XX days

RFeyertag — Tue, 15 Aug 2023 20:40:24 GMT

Hello @mavega,

this would help us in the part "malware flew under the radar". We also see the rare processes in the company and can investigate deeper, if we want.

Thanks for your research!

Rob

Re: XQL - list of processes, which were not started/launched in the last XX days

mavega — Wed, 16 Aug 2023 18:42:56 GMT

Hi RFeyertag,

We are still looking into this one, not sure Cortex works that way, but if you have Host Insight add-on maybe you can try the below script, it might not provide the non running processes but it will show the state of them and you might be able to sort them out (script is for 30 days but you can change it):

preset = host_inventory_services 
| alter More_Than_30D = if((timestamp_diff(current_time(),report_timestamp  ,"day")>=30) , "True", "False")
| filter (More_Than_30D != """False""") 
| filter started = "false"
| fields  service_name ,report_timestamp , More_Than_30D , service_state , service_type , endpoint_name , started 
| dedup service_name