xql query for process

T.Nurmi — Fri, 24 Oct 2025 09:59:09 GMT

Hi. i just try to do some basic threat hunting.

dataset = xdr_data
| filter action_process_image_name in ("a.exe", "b.exe")
| fields agent_hostname, actor_effective_username, action_process_image_name, action_process_image_command_line , _time
| sort desc _time

so i try to identfied two different process is happening at same endpoints. how to do that . current query just collect all process and i just want fiter that if those process happen> then i got event> example Process chrome start some other process

Re: xql query for process

eluis — Fri, 31 Oct 2025 10:05:55 GMT

Hi @T.Nurmi

Im not sure what you mean here.

Are you looking for parent/child process ?

Two different independent processes ?

As per your question if those processes happen, I can tell you that if you get data from a process in a query, this means that the logs are there so the process was present there

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thank you.

Luis

topic Re: xql query for process in Cortex XDR Discussions

xql query for process

Re: xql query for process