Cortex XDR XQL query

[Vinothkumar_SBA]

Hi Community,

I have a query regarding XQL. I have a list of over 100 approved application names available. How can I easily find the unapproved applications installed on machines, compared to the approved application versions?

[aspatil · Accepted solution]

Hello @Vinothkumar_SBA ,

Thanks for reaching out on LiveCommunity!

The sample should be like below, you can include the list of applications:

preset = host_inventory_applications
| filter application_name not in("","")

If you feel this has answered your query, please let us know by clicking on Like and "mark this as a Solution".

[Vinothkumar_SBA]

Hi Aspatil,

I used this query to filter the unapproved applications, but the default services are still showing up in the query results on the Linux machine. Could you please help with this problem?

[aspatil]

Hello @Vinothkumar_SBA ,

Please try applying filter for operating system and create different queries as per the OS type.

Regards,

Ashutosh