Need help with XQL query to report deleted files

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Need help with XQL query to report deleted files

L1 Bithead

Dear Sir,

Please if anyone can help to advise the XQL query to create a custom report to capture the "File Delete" activities in one particular server?

I know we can create the same from Query Builder, but from Query Builder it will only return 10,000 records. In addition, we not able to email the result as attachment (or if i am wrong with this understanding?).

Any help and advise is very appreciated.

 

Regards,

 

 

 

1 accepted solution

Accepted Solutions

L4 Transporter

Hi @chinsiongwong 

thanks for writing us in LiveCommunity. 

Please try the following XQL query

 

dataset =xdr_data
| filter event_type = ENUM.FILE and event_sub_type = FILE_REMOVE and agent_hostname_here = "your_server_hostname "
| fields agent_hostname, agent_version, action_file_path , event_sub_type, event_type
| dedup action_file_path
| limit 1000 

. Please notice that: You can use this query and save it as a widget and save the results as csv file which can be exported in from of reports 

The limit = 1000 will limit your results. If results are bigger than 20MB you wont be able to export them.

Replace your_server_hostname by the name of your server you want to monitor

 

Please granularity your reports as much as you can/want

 

I hope this helps. Mark this as a solution if it helps

 

KR,

Luis 

 

View solution in original post

3 REPLIES 3

L4 Transporter

Hi @chinsiongwong 

thanks for writing us in LiveCommunity. 

Please try the following XQL query

 

dataset =xdr_data
| filter event_type = ENUM.FILE and event_sub_type = FILE_REMOVE and agent_hostname_here = "your_server_hostname "
| fields agent_hostname, agent_version, action_file_path , event_sub_type, event_type
| dedup action_file_path
| limit 1000 

. Please notice that: You can use this query and save it as a widget and save the results as csv file which can be exported in from of reports 

The limit = 1000 will limit your results. If results are bigger than 20MB you wont be able to export them.

Replace your_server_hostname by the name of your server you want to monitor

 

Please granularity your reports as much as you can/want

 

I hope this helps. Mark this as a solution if it helps

 

KR,

Luis 

 

L1 Bithead

Dear Eluis,

One more question - please can we further filter the query by ext, for example "doc", "docx", "ppt". "pptx", etc etc?

Thank you very much

L1 Bithead

Please ignore this. Got it works.

 

Thank you very much.

  • 1 accepted solution
  • 1368 Views
  • 3 replies
  • 0 Likes
  • 78 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!