File lookup

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

File lookup

L1 Bithead

Is it possible to check if a file is present on any system in network through Cortex XDR based on file name or the hash value of the file.

1 REPLY 1

L5 Sessionator

Hi @VineethArumulla ,

 

Thank you for writing to live community!

 

As I understand you intend to lookup for presence of files or hashes in the endpoints using Cortex XDR. This is possible using the host insights "File Search" feature. If you have Cortex XDR Pro Per Endpoints license and Host-Insights add-on license, then you need to enable "Host Insights Capabilities". 

Screenshot 2023-02-02 at 8.44.12 PM.png

If this enabled, then you can search for files by file paths or file hashes under the "Action Center" items. Select the file path with(or without) wildcards. You should be able to find the details for the same. 

Screenshot 2023-02-02 at 8.47.18 PM.png

 

Alternatively, if you do not have the add-on license, then you can query for file names using Cortex XDR query builder.  This would only happen provided if the file activity has been reported by Cortex XDR. 

 

Hope this helps!

 

 

 

 

  • 1031 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!