Query to see user that launched an EXE and how many times

[J.Suter]

I've been trying so many different queries and cant seem to make one that shows me what users launched an EXE and when or how many times as a count.

As an example to make it easy:

Search for everyone that executed winword.exe and show me when they did it. 

Or search of everyone that executed winword.exe and count of times in X range

If anyone has a query and could share it that would be so helpful, I'm having a hard time getting my schema to work.

Thank you so much!
Cortex XDR 

Edit: I have this working, but I'm not stuck on how to make a count: the "winword.exe" will become $Application for my user base.

dataset = xdr_data
 | filter action_process_image_name = "winword.exe"
 | fields agent_hostname , actor_effective_username , action_process_image_name , action_process_image_path 
 | sort desc _time 

Got it, leaving this here for anyone else that may need this information:

dataset = xdr_data
 | filter action_process_image_name = "winword.exe"
 | fields agent_hostname , actor_effective_username , action_process_image_name , action_process_image_path
 | comp count(actor_effective_username) as counter by actor_effective_username
 | sort desc Counter

[mbasutkar]

Hi,

You can use the below XQL query to search the file executions

config timeframe = 7d
|dataset = xdr_data
| filter event_type = ENUM.PROCESS
| filter actor_process_image_name = "chrome.exe"
| fields _time, agent_hostname, actor_effective_username, actor_process_image_name, actor_process_image_path, actor_process_image_md5, actor_process_file_create_time, actor_process_execution_time, actor_process_signature_product, actor_process_file_internal_name
| sort desc _time

Please accept this solution if this resolves your query.

Regards,

Manjunath Basutkar

[J.Suter · Accepted solution]

Issue was solved in the initial post, found the proper schema to use to find all the data needed, see main comment: https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/query-to-see-user-that-launched-an-exe-a...