searching a specific service or file query on cortex xdr using query builder.

Prashanta — Wed, 27 Dec 2023 05:34:36 GMT

I want to search a specific process name xyz.exe, or xyz.dll which is already running or previously executed.

How can I do it both in single search?

Re: searching a specific service or file query on cortex xdr using query builder.

aspatil — Fri, 29 Dec 2023 04:18:11 GMT

Thank you for writing to live community.

You can use below as an example:

dataset = xdr_data
| filter action_module_path contains "abc.dll" or action_process_image_name = "abc.exe"

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.