Searching for multiple hashes on cortex XDR

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Searching for multiple hashes on cortex XDR

L1 Bithead

Does anyone know a way to search for multiple hashes on Cortex XDR?

file_search = existing_files does not allow any operators other than "=" for the sha values and you can't string multiple in a query. 

I feel like I'm missing something and there should be a way to do that that I'm not aware of. 

 

Any ideas?

3 REPLIES 3

L4 Transporter

Hey @rufat87,

 

Thanks for reaching out on LIVEcommunity!

 

It appears you're looking for a field you can use the "in" operator with.  Use of the "in" operators looks like this


dataset = xdr_data
| filter action_file_sha256 in ("4138198e8b807e106ad7c256bfe9bd4e9d9a2de3473367405bc3c299cc774294", "f491caeb1a1b561b0d87efcb17deb79e63eb993940a6d34346dea6504f7c9400")
| fields _time, action_file_name



Alternatively, you have the option of using the query builder and using a pipe ( | ) to separate multiple values in any field.

 

Screen Shot 2023-03-23 at 11.46.04 AM.png

A display of the results is below (I used dummy hash values so there are no results, I wanted to draw your attention to the query itself).

Screen Shot 2023-03-23 at 11.47.08 AM.png

I hope this information helps.  For future reference I'll provide you with a great XQL resource.

 

If you have any other questions or if I didn't answer your question fully please feel free to respond here.

 

Have a great day!

Thanks for responding, I was aware of such file search. I was hoping a search against files existing on the hosts via sha would also have an option of multiple value input. I guess you are saying that is not possible for file_search = existing_files xql query?

L0 Member

Since this question is still open to discussion, I have the similar question... is it possible to build such a query to search across multiple hashes from external data files GitHub, etc.? MS example that kind of query search:
| where SHA1 in (externaldata(hash:string)[URL])... thanks for any info. on that.

  • 1881 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!