topic Re: Cortex XDR Pro - Looking for Scheduled tasks by name in mass? in Cortex XDR Discussions

Cortex XDR Pro - Looking for Scheduled tasks by name in mass?

RFeyertag — Sun, 21 Apr 2024 22:02:02 GMT

Hello dear community,

here is a script for searching specific scheduled tasks by name in mass. The search is via LIKE and wildcards are used.

import subprocess import sys def ScheduledTask(scheduler_name): # PowerShell-Befehl mit Where-Object und Filterung für den TaskScheduler pscommand = f"""Get-ScheduledTask | Where-Object {{$_.TaskName -like '*{scheduler_name}*'}} | ForEach-Object {{ $_.TaskName + "|" + $_.State }}""" try: # PowerShell-Befehl ausführen und Ausgabe erfassen result = subprocess.check_output(["powershell", "& {" + pscommand + "}"], text=True, encoding='utf-8', errors='ignore') # Ergebnis anzeigen oder weiterverarbeiten return result.strip() except subprocess.CalledProcessError as e: # Fehlerbehandlung, falls der Befehl nicht erfolgreich ist sys.stderr.write(f"Fehler bei der Ausführung des Befehls: {e}") return None # Vorherige Festlegung des TaskScheduler-Namens scheduler_name = "MeinTaskScheduler" # Aufruf der Funktion mit dem festgelegten TaskScheduler-Namen output = ScheduledTask(scheduler_name) # Ausgabe des Ergebnisses ohne Header print(output)

Have fun with it!

Rob

Re: Cortex XDR Pro - Looking for Scheduled tasks by name in mass?

jmazzeo — Tue, 23 Apr 2024 19:00:30 GMT

Thanks for sharing!

Re: Cortex XDR Pro - Looking for Scheduled tasks by name in mass?

RFeyertag — Tue, 23 Apr 2024 20:48:12 GMT

You're welcome 🙂

Re: Cortex XDR Pro - Looking for Scheduled tasks by name in mass?

Frank-Bussink — Tue, 10 Dec 2024 10:43:26 GMT

Hi,

i took the liberty to use your code and to evolve it, by passing the scheduler_name as an argument of the script

import subprocess import sys def ScheduledTask(scheduler_name): # PowerShell command using Where-Object and filtering for the TaskScheduler pscommand = f"""Get-ScheduledTask | Where-Object {{$_.TaskName -like '*{scheduler_name}*'}} | ForEach-Object {{ $_.TaskName + "|" + $_.State }}""" try: # Execute PowerShell command and capture output result = subprocess.check_output(["powershell", "& {" + pscommand + "}"], text=True, encoding='utf-8', errors='ignore') # Display or further process the result return result.strip() except subprocess.CalledProcessError as e: # Error handling if the command is not successful sys.stderr.write(f"Error executing the command: {e}") return None if __name__ == "__main__": print(main(sys.argv[1]))