Searching for multiple hashes on cortex XDR

[rufat87]

Does anyone know a way to search for multiple hashes on Cortex XDR?

file_search = existing_files does not allow any operators other than "=" for the sha values and you can't string multiple in a query. 

I feel like I'm missing something and there should be a way to do that that I'm not aware of. 

Any ideas?

[anlynch]

Hey @rufat87,

Thanks for reaching out on LIVEcommunity!

It appears you're looking for a field you can use the "in" operator with.  Use of the "in" operators looks like this

dataset = xdr_data
| filter action_file_sha256 in ("4138198e8b807e106ad7c256bfe9bd4e9d9a2de3473367405bc3c299cc774294", "f491caeb1a1b561b0d87efcb17deb79e63eb993940a6d34346dea6504f7c9400")
| fields _time, action_file_name

Alternatively, you have the option of using the query builder and using a pipe ( | ) to separate multiple values in any field.

A display of the results is below (I used dummy hash values so there are no results, I wanted to draw your attention to the query itself).

 

I hope this information helps.  For future reference I'll provide you with a great XQL resource.

If you have any other questions or if I didn't answer your question fully please feel free to respond here.

Have a great day!

[rufat87]

Thanks for responding, I was aware of such file search. I was hoping a search against files existing on the hosts via sha would also have an option of multiple value input. I guess you are saying that is not possible for file_search = existing_files xql query?

[VidRupnik]

Since this question is still open to discussion, I have the similar question... is it possible to build such a query to search across multiple hashes from external data files GitHub, etc.? MS example that kind of query search:
| where SHA1 in (externaldata(hash:string)[URL])... thanks for any info. on that.