XQL: How to find events from multiple host

I.Naseer — Mon, 30 Dec 2024 07:14:43 GMT

Hi,

We need an XQL query that can identify events from multiple host that we define in the query.

Thank you.

Re: XQL: How to find events from multiple host

jmazzeo — Mon, 30 Dec 2024 18:38:35 GMT

Hi @I.Naseer, thanks for reaching us using the Live Community.

You can filter multiple hostnames by using the "in" operator in a filter, like in this example:

dataset = xdr_data | filter agent_hostname in ("Hostname1", "Hostname2") // Ad many hostnames as requiered

If this post answers your question, please mark it as the solution.