topic Re: XQL query for host inventory with versions in Cortex XDR Discussions

XQL query for host inventory with versions

JustJulian — Fri, 28 Mar 2025 10:11:18 GMT

Hi,

I need a XQL query which outputs all endpoints and installed versions of a specific application. I found a way to get all computers with the application installed, but no version of it:

Just kind of similar to the Host Insights, which outputs the version of the application. Any help would be appreciated.

Thanks!

Re: XQL query for host inventory with versions

aspatil — Fri, 28 Mar 2025 11:51:23 GMT

Hello @JustJulian ,

Here you go:
dataset = host_inventory
| filter applications != null
| arrayexpand applications
| alter applications=json_extract(applications, "$.application_name"), software_vendor = json_extract(applications, "$.vendor"), software_verion = json_extract(applications, "$.version")
| filter applications contains "google chrome"
| fields applications, host_name, software_vendor , software_verion
| dedup host_name by asc host_name

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

Re: XQL query for host inventory with versions

JustJulian — Fri, 28 Mar 2025 13:03:03 GMT

Thank you, this works great!