topic Re: xql query for file \ folder name. in Cortex XDR Discussions

xql query for file \ folder name.

Prashanta — Sun, 28 Jan 2024 06:02:55 GMT

How can I locate a particular file or folder across all endpoints?
file or folder name : bihmplhobchoageeokmgbdihknkjbknd

Thanks community

Re: xql query for file \ folder name.

abdrahman — Mon, 29 Jan 2024 10:56:52 GMT

Dear @Prashanta,

Hope you are doing well, and thank you for reaching out to our live community. From the above query I understand that you would like to search for a file or a folder across the environment.

Please try the query below and see if you are able to get the desired results, thank you.

preset = xdr_file
| filter agent_hostname = "Host_name" // To filter a particular host
| filter action_file_name contains "file.txt" // To find file by file name
| filter (action_file_path contains """test_folder""") //To find the folder by folder name

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

Re: xql query for file \ folder name.

aspatil — Mon, 29 Jan 2024 12:22:25 GMT

Hello,

I believe you want to locate the file or path across all endpoints. I am adding my suggestions for the same,

File name:

preset = xdr_file
|filter action_file_name contains "usage"
|fields action_file_name ,_time , agent_hostname ,agent_ip_addresses ,agent_mac_addresses ,agent_os_type , action_file_path

Folder path:

preset = xdr_file
|filter action_file_path contains """test_folder"""
|fields action_file_path ,_time , agent_hostname ,agent_ip_addresses ,agent_mac_addresses ,agent_os_type , action_file_path

By running just "preset = xdr_file" in Query builder, you will see multiple fields. You can modify the filed or join with another tables to get more information and modify the query as per the requirement.

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

Re: xql query for file \ folder name.

Prashanta — Tue, 30 Jan 2024 09:56:54 GMT

Its works. Thank you.