02-02-2023 02:48 AM
Is it possible to check if a file is present on any system in network through Cortex XDR based on file name or the hash value of the file.
02-02-2023 05:22 AM
Hi @VineethArumulla ,
Thank you for writing to live community!
As I understand you intend to lookup for presence of files or hashes in the endpoints using Cortex XDR. This is possible using the host insights "File Search" feature. If you have Cortex XDR Pro Per Endpoints license and Host-Insights add-on license, then you need to enable "Host Insights Capabilities".
If this enabled, then you can search for files by file paths or file hashes under the "Action Center" items. Select the file path with(or without) wildcards. You should be able to find the details for the same.
Alternatively, if you do not have the add-on license, then you can query for file names using Cortex XDR query builder. This would only happen provided if the file activity has been reported by Cortex XDR.
Hope this helps!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
