searching a specific service or file query on cortex xdr using query builder.

[Prashanta]

I want to search a specific process name xyz.exe, or xyz.dll which is already running or previously executed.

How can I do it both in single search? 

Cortex XDR Endpoint Protection 

[aspatil]

Hello @Prashanta ,

Thank you for writing to live community.

You can use below as an example:

dataset = xdr_data
| filter action_module_path contains "abc.dll" or action_process_image_name = "abc.exe"

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.