Cortex XDR does not show file name

[JahidAliyev]

Hello everyone, 

I have an incident and when I open related logs, it is showing large upload. I can see a bunch of logs which indicates that someone has uploaded 53 mb file to amazon or one drive. I saw destionation host as ........amazon.com and initiatior path as ...../msedge. Unfortunately I could not see the file name itself. What can be reason for that? 

[jmazzeo]

Hi @JahidAliyev, thanks for reaching us using the Live Community.

You can try this XQL as an example, and start working from here:

Spoiler

dataset = xdr_data
| filter event_type = ENUM.FILE and event_sub_type = ENUM.FILE_OPEN
| filter actor_process_image_name in ("chrome.exe","edge.exe","firefox.exe")
| fields agent_hostname, agent_ip_addresses,dst_action_external_hostname, action_file_name, action_file_path, action_file_size

If this post answers your question, please mark it as the solution.