Query for listing installed VPN's in organization

[DragomirGaliaIT]

Hey everyone,

I'm trying to list all devices within organization that have installed some VPN on them, but my query fails each time or returns small number of results. I set it to have most popular 10 VPN's in the list like Nord, OpenVPN, Express, Cyber Ghost etc.

Could you please help me out in adjusting query, to list hostname of the devices and the installed VPN:

dataset = xdr_data
| filter actor_process_image_name in(" *VPN*, ")
| comp
values(actor_process_image_path ) by agent_hostname, actor_effective_username

[bbucao · Accepted solution]

Hi DragomirGaliaIT,

The query example you listed has some slight syntax errors. To search for for a match on the process name  using the "in" operator, make sure you have each value in quotes and separated by a coma as shown below. Another suggestion would be using the digital signer field and searching for these VPN's digital signer for a more thorough search.

dataset = xdr_data
| filter actor_process_image_name in("*nord*", "*express*")
| comp
values(actor_process_image_path ) by agent_hostname, actor_effective_username


Thanks,
Ben