Cortex XDR does not show file name

JahidAliyev — Thu, 28 Nov 2024 12:08:45 GMT

Hello everyone,

I have an incident and when I open related logs, it is showing large upload. I can see a bunch of logs which indicates that someone has uploaded 53 mb file to amazon or one drive. I saw destionation host as ........amazon.com and initiatior path as ...../msedge. Unfortunately I could not see the file name itself. What can be reason for that?

Re: Cortex XDR does not show file name

jmazzeo — Mon, 02 Dec 2024 19:00:02 GMT

Hi @JahidAliyev, thanks for reaching us using the Live Community.

You can try this XQL as an example, and start working from here:

dataset = xdr_data
| filter event_type = ENUM.FILE and event_sub_type = ENUM.FILE_OPEN
| filter actor_process_image_name in ("chrome.exe","edge.exe","firefox.exe")
| fields agent_hostname, agent_ip_addresses,dst_action_external_hostname, action_file_name, action_file_path, action_file_size

If this post answers your question, please mark it as the solution.

topic Re: Cortex XDR does not show file name in Cortex XDR Discussions

Cortex XDR does not show file name

Re: Cortex XDR does not show file name