Need help with XQL query to report deleted files

[chinsiongwong]

Dear Sir,

Please if anyone can help to advise the XQL query to create a custom report to capture the "File Delete" activities in one particular server?

I know we can create the same from Query Builder, but from Query Builder it will only return 10,000 records. In addition, we not able to email the result as attachment (or if i am wrong with this understanding?).

Any help and advise is very appreciated.

Regards,

[eluis · Accepted solution]

Hi @chinsiongwong 

thanks for writing us in LiveCommunity. 

Please try the following XQL query

dataset =xdr_data
| filter event_type = ENUM.FILE and event_sub_type = FILE_REMOVE and agent_hostname_here = "your_server_hostname "
| fields agent_hostname, agent_version, action_file_path , event_sub_type, event_type
| dedup action_file_path
| limit 1000 

. Please notice that: You can use this query and save it as a widget and save the results as csv file which can be exported in from of reports 

The limit = 1000 will limit your results. If results are bigger than 20MB you wont be able to export them.

Replace your_server_hostname by the name of your server you want to monitor

Please granularity your reports as much as you can/want

I hope this helps. Mark this as a solution if it helps

KR,

Luis 

[chinsiongwong]

Dear Eluis,

One more question - please can we further filter the query by ext, for example "doc", "docx", "ppt". "pptx", etc etc?

Thank you very much

[chinsiongwong]

Please ignore this. Got it works.

Thank you very much.