XQL Query to find bugcheck (BSOD) entries in event logs

ianatgrafton — Sat, 30 Nov 2024 10:25:52 GMT

We are experiencing a few BSOD events when auto-upgrade pushes new agents.

Anecdotally, it only seems to happen to a small number of machines and well below 1% of the total XDR estate, however this is anecdotal and I keep getting challenged that "only IT people would report it"

I need to go an investigate how many BSOD events happened in a particular time frame during the last agent upgrade and I wondered of this could be done with XQL and how I might start

I tried a very simple query using the wizard just looking for events that contain (=~) bugcheck but this brought no results not even the ones I know had an event, so clearly I've misunderstood something here

Any ideas?

Re: XQL Query to find bugcheck (BSOD) entries in event logs

ianatgrafton — Sat, 30 Nov 2024 10:33:50 GMT

I also tried to use \bbugcheck\b incase it wanted regex in the =~ field

Re: XQL Query to find bugcheck (BSOD) entries in event logs

maximk — Mon, 02 Dec 2024 14:58:20 GMT

Apparently, I would use agent script execution to collect BSOD events data.

topic Re: XQL Query to find bugcheck (BSOD) entries in event logs in Cortex XDR Discussions

XQL Query to find bugcheck (BSOD) entries in event logs

Re: XQL Query to find bugcheck (BSOD) entries in event logs

Re: XQL Query to find bugcheck (BSOD) entries in event logs