topic Cortex XDR XQL query in Cortex XDR Discussions

Cortex XDR XQL query

Vinothkumar_SBA — Mon, 29 Jul 2024 11:47:32 GMT

Hi Community,

I have a query regarding XQL. I have a list of over 100 approved application names available. How can I easily find the unapproved applications installed on machines, compared to the approved application versions?

Re: Cortex XDR XQL query

aspatil — Tue, 30 Jul 2024 05:51:19 GMT

Hello @Vinothkumar_SBA ,

Thanks for reaching out on LiveCommunity!

The sample should be like below, you can include the list of applications:

preset = host_inventory_applications
| filter application_name not in("","")

If you feel this has answered your query, please let us know by clicking on Like and "mark this as a Solution".

Re: Cortex XDR XQL query

Vinothkumar_SBA — Wed, 07 Aug 2024 14:15:21 GMT

Hi Aspatil,

I used this query to filter the unapproved applications, but the default services are still showing up in the query results on the Linux machine. Could you please help with this problem?

Re: Cortex XDR XQL query

aspatil — Thu, 08 Aug 2024 06:16:45 GMT

Hello @Vinothkumar_SBA ,

Please try applying filter for operating system and create different queries as per the OS type.

Regards,

Ashutosh