topic Re: Need help sorting my applications and endpoint names using an XQL query in Cortex XDR Discussions

Need help sorting my applications and endpoint names using an XQL query

Prashanta — Tue, 12 Dec 2023 05:25:13 GMT

I want to sort my endpoint based on all application, like which application are using which specific endpoint? using an XQL query.
#xql_query

Re: Need help sorting my applications and endpoint names using an XQL query

aspatil — Tue, 12 Dec 2023 06:52:44 GMT

Hello @Prashanta ,

Thank you for writing to live community.

You can use below query as a sample and modify it as per your requirement:

preset = host_inventory_applications

|fields Vendor, application_name, version, manager_name, endpoint_name

if you need the application on the number of endpoints, use below:

preset = host_inventory_applications

|fields Vendor, application_name, version, manager_name, endpoint_name
|comp count(endpoint_name) as counter by vendor, application_name, version, manager_name
|sort desc counter

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

Regards

Re: Need help sorting my applications and endpoint names using an XQL query

Prashanta — Thu, 28 Dec 2023 05:17:54 GMT

Hello @aspatil
Thanks for the reply, If I add with this parameter OS type, OS version ...? how can i do that? like need windows information.

preset = host_inventory_applications

|fields Vendor, application_name, version, manager_name, endpoint_name,

Re: Need help sorting my applications and endpoint names using an XQL query

aspatil — Thu, 28 Dec 2023 16:04:04 GMT

Hello @Prashanta ,

You can use below and play around it:

preset = host_inventory_applications
|fields Vendor, application_name, version, manager_name, endpoint_name
|join (preset = host_inventory_endpoints | fields endpoint_name , operating_system, os_type, endpoint_type )
as ep ep.endpoint_name = endpoint_name

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

Re: Need help sorting my applications and endpoint names using an XQL query

Prashanta — Sat, 30 Dec 2023 03:17:33 GMT

Hello @aspatil
Thanks for the reply, I need the OS_version also like, Windows 10, 10.0.10240
i can't get the os version with query, but it exists on host inventory > application > operating system > os version.

Regards.
prashanta

Re: Need help sorting my applications and endpoint names using an XQL query

aspatil — Thu, 18 Jan 2024 15:17:18 GMT

Hello @Prashanta ,

preset = host_inventory_applications
|fields Vendor, application_name, version, manager_name, endpoint_name
|join(dataset = endpoints | fields endpoint_name ,operating_system, os_version, platform, endpoint_type)
as ep ep.endpoint_name = endpoint_name

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.