Need help sorting my applications and endpoint names using an XQL query

[Prashanta]

I want to sort my endpoint based on all application, like which application are using which specific endpoint? using an XQL query.
Cortex XDR #xql_query

[aspatil]

Hello @Prashanta ,

Thank you for writing to live community.

You can use below query as a sample and modify it as per your requirement:

preset = host_inventory_applications

|fields Vendor, application_name, version, manager_name, endpoint_name

if you need the application on the number of endpoints, use below:

preset = host_inventory_applications

|fields Vendor, application_name, version, manager_name, endpoint_name
|comp count(endpoint_name) as counter by vendor, application_name, version, manager_name
|sort desc counter

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

Regards

[Prashanta]

Hello @aspatil 
Thanks for the reply, If I add with this parameter OS type, OS version ...? how can i do that? like need windows information. 

preset = host_inventory_applications

|fields Vendor, application_name, version, manager_name, endpoint_name,

[aspatil]

Hello @Prashanta ,

You can use below and play around it:

preset = host_inventory_applications
|fields Vendor, application_name, version, manager_name, endpoint_name
|join (preset = host_inventory_endpoints | fields endpoint_name , operating_system, os_type, endpoint_type )
as ep ep.endpoint_name = endpoint_name

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

[Prashanta]

Hello @aspatil 
Thanks for the reply, I need the OS_version also like, Windows 10,  10.0.10240
i can't get the os version with query, but it exists on host inventory > application > operating system > os version.

Regards. 
prashanta 

[aspatil]

Hello @Prashanta ,

preset = host_inventory_applications
|fields Vendor, application_name, version, manager_name, endpoint_name
|join(dataset = endpoints | fields endpoint_name ,operating_system, os_version, platform, endpoint_type)
as ep ep.endpoint_name = endpoint_name

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.