XQL Query to look for a certain username on the domain on what devices they logged on to.

Joe-Oberfoell — Fri, 22 Mar 2024 14:35:08 GMT

I have other tools that I can scan our entire network looking, but its time consuming to setup and run. This need has come up before., when creds are being used suspiciously and we want to see where all they are logging on.

I think running a XQL may be a time saver if I can figure it out.

Re: XQL Query to look for a certain username on the domain on what devices they logged on to.

jmazzeo — Fri, 22 Mar 2024 17:46:19 GMT

Hi @Joe-Oberfoell, thanks for reaching us using the Live Community.

In the XQL Query Library you can find one pre-defined query called "All successful logins by a user" where you can set the username and it will search the xdr_data dataset for login events from that user.

Try it and check how it goes, you can modify the query as you need to fulfill your needs.

If this post answers your question, please mark it as the solution.

topic Re: XQL Query to look for a certain username on the domain on what devices they logged on to. in Cortex XDR Discussions

XQL Query to look for a certain username on the domain on what devices they logged on to.

Re: XQL Query to look for a certain username on the domain on what devices they logged on to.