Need to extract installed application.

[OsamaKhan]

Hi,

I have queries regarding cortex XDR,

Does the cortex xdr provide application inventory counts?

We want to extract each and every application which is installed in all our network systems but with IP.

for e.g, 10.10.10.10 is a system IP, I want to extract how many other applications are installed in this particular IP.

From host insight, we get the list but we want with IP or user.

[malalade]

Yes. There are multiple workarounds.
1. You can either use the "Endpoint Administration" Tab to get the equivalent "hostname" of the "IP Address"/"user" and then use "quick Launcher" on the top right to get the "Asset View" of the endpoint
Change the view to applications. That provide the list of application and the count

2. Alternatively, you can use XQL query. Target "Host Inventory" table
Note:

Agent_id is the primary key for the host inventory table. But you can execute the query with a filter such as
- host_name
- ip_addresses
- users
Also, note the timeframe specified because host inventory collection happens daily and you could have multiple counts

With IP Address

dataset = host_inventory
| filter ip_addresses = "10.10.10.10"
| arrayexpand applications
| alter apps = json_extract(applications, "$.application_name")
| fields apps

To make it a re-usable query, change the hardcoded IP Address to "$system_ip" and save it into your query library
Whenever you want to use the query, you will need to supply the target IP Address as the parameter. See attached screenshot

dataset = host_inventory
| filter ip_addresses = "$system_ip"
| arrayexpand applications
| alter apps = json_extract(applications, "$.application_name")
| fields apps

With User name

change the target_user e.g. Smith (case sensitive)

dataset = host_inventory
| arrayexpand users
| alter target_user = json_extract(users, "$.name")
| filter (target_user = "\"target_user\"")
| arrayexpand applications
| alter apps = json_extract(applications, "$.application_name")
| fields apps

For the count of applications per IP Address

dataset = host_inventory
| filter ip_addresses = "10.10.10.10"
| arrayexpand applications
| alter apps = json_extract(applications, "$.application_name")
| dedup apps by asc _time
| comp count(apps) as Counter by _time