topic Re: How to check powershell version at cortex XDR in Cortex XDR Discussions

How to check powershell version at cortex XDR

G.Cai500031 — Tue, 15 Apr 2025 06:12:33 GMT

Hi everyone,

I'm a beginner of Cortex XDR.

I need to confirm what devices have older versions of powershell installed and when I search for apps named powershell using host inventory I can only get 300+ results for powershell 7.

I changed some keywords, i seems all other versions below powershell 7 are not searchable.

And I tried to use query builder to find files named powershell I could find more than 8000 results, apparently cortex is able to find older versions of powershell I just don't know the right way to do it.

Re: How to check powershell version at cortex XDR

aspatil — Wed, 16 Apr 2025 05:29:46 GMT

Hello @G.Cai500031 ,

You may try below:
dataset = host_inventory
| filter applications != null
| arrayexpand applications
| alter app_name = json_extract(applications, "$.application_name"),
app_version = json_extract(applications, "$.version")
| filter app_name contains "powershell"
| filter app_version < "7"
| fields host_name, app_name, app_version
| sort asc host_name

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

Re: How to check powershell version at cortex XDR

G.Cai500031 — Thu, 17 Apr 2025 02:56:56 GMT

Hi Aspatil,

Thank you for your reply.

I tried these commod but can only find 285 results.

It seems in the data set of host invebtory only have powershell 7 's information..

Re: How to check powershell version at cortex XDR

aspatil — Thu, 17 Apr 2025 07:11:31 GMT

There is a filter applied to display versions less that 7. You can modify it as per your requirement.

Re: How to check powershell version at cortex XDR

G.Cai500031 — Thu, 17 Apr 2025 07:24:32 GMT

I do use the filter. But no result found.

It seems Cortex didn't collect all the information.

Anyway, thank you for your answer. 🙂