topic Re: XQL query to get the list of new software/applications in Cortex XDR Discussions

XQL query to get the list of new software/applications

S.Ahmad — Tue, 19 Mar 2024 18:37:53 GMT

Looking for help. I would like to come up with the query to find all new applications installed compare to the last month inventory.

The logic would be what new application/software have been installed on the hosts this month.

Re: XQL query to get the list of new software/applications

aspatil — Thu, 21 Mar 2024 08:13:26 GMT

Hello @S.Ahmad ,

Thanks for reaching out on LiveCommunity!

Please refer to below query:

preset = host_inventory_applications
| fields application_name , vendor , version , endpoint_name, install_date
| alter aa = parse_timestamp("%Y-%m-%d", format_string("%s",install_date ))
| alter diffdiff = timestamp_diff(current_time(), aa, "DAY")
| filter diffdiff <30

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

Re: XQL query to get the list of new software/applications

S.Ahmad — Thu, 21 Mar 2024 19:35:13 GMT

Worked and thank you very much.

Re: XQL query to get the list of new software/applications

M.Akshat — Tue, 19 Aug 2025 13:46:08 GMT

Hello,

I'm trying to create a BIOC rule based on this XQL query and it's giving me errors. The error is "preset name is invalid - does not exist". Can you help me fix this error?

Re: XQL query to get the list of new software/applications

jmazzeo — Tue, 19 Aug 2025 13:47:42 GMT

Hi!, what's the preset name you are trying to use? It's covered by the pop-up text in the screenshot.

Re: XQL query to get the list of new software/applications

M.Akshat — Tue, 19 Aug 2025 13:49:56 GMT

It's the same as the provided solution query: host_inventory_applications