topic Export/Import filters in Cortex XDR Discussions

Export/Import filters

Piotr_Kowalczyk — Mon, 19 Feb 2024 15:00:26 GMT

Hi,

In the Host Inventory/Applications I can filter programs then save the filter and open it when needed. However it would be very helpful if I could export this filter, modify it in editor and import again. Is any way to do this? I'm just trying to exclude decent number of application from my view and adding them manually to the filer in dashboard is very problematic. Perhaps there is other way to achieve it, like adding multiple application to the filter in dashboard instead doing it one by one?

Re: Export/Import filters

aspatil — Wed, 21 Feb 2024 10:05:05 GMT

Hello @Piotr_Kowalczyk ,

Thank you for reaching out to our live community.

Unfortunately you cannot export the filter as of now. The alternate solution will be to to create a query and exclude the list of applications you have and make a dashboard out of it.

preset = host_inventory_applications
| fields application_name , vendor , version , endpoint_name

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

Re: Export/Import filters

Piotr_Kowalczyk — Wed, 21 Feb 2024 10:20:34 GMT

Thank you for your reply.

Just two questions:

1. Is it possible to add multiple values in the dashboard filter (copy/paste) instead of adding them one by one? I wasn't able to find a solution for this, when I pasted multiple values it showed as one and didn't filter correctly.

2. Is it possible to filter values in query with NOT CONTAINS but for multiple values? I know I can use NOT IN (value1,value2) abut is is possible to do this with contains?

Re: Export/Import filters

aspatil — Thu, 22 Feb 2024 15:16:59 GMT

Hello @Piotr_Kowalczyk ,

1. You can do copy/paste and hit enter to add multiple application as shown in the image.

2. You cannot use Not Contains as like Not In, you have to use OR operator. You can refer below query as an example.

preset = host_inventory_applications
| fields application_name , vendor , version , endpoint_name
|filter application_name not contains "7-Zip 23.01 (x64)" or application_name not contains "Git"

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

Re: Export/Import filters

Piotr_Kowalczyk — Thu, 22 Feb 2024 15:36:48 GMT

Thanks for your reply.

1. Whatever I try I'm ending with applications pasted in one line instead of multiple values.

2. I was more looking for a way to have everything separated with comas, like (app1,app2.app3) because this would simplify coping/paste from the list.

Re: Export/Import filters

aspatil — Fri, 23 Feb 2024 08:22:27 GMT

Hello @Piotr_Kowalczyk ,

You have to copy paste each application.

Re: Export/Import filters

Piotr_Kowalczyk — Tue, 27 Feb 2024 12:41:47 GMT

Thank you, at least I have clarity now.