To find the hashes of the applications through XQL search

[pv_anayaa]

Hi team,

is there a query to get the hashes of the applications installed in host inventories or any other way ?

[bbucao]

Hi Pv_anayaa,

The list of applications collected by host-insights and displayed in the XDR UI or via XQL does not include hashes. Hashes are calculated and collected for process execution events however, so while the query below would not give you a comprehensive list of installed applications with their hashes, it will show you what processes/applications have been run during the defined timeframe, and includes their hashes. You could then use XQL to create a custom dataset with this data, and schedule a query to append the custom dataset anytime a new process name is seen.

preset = xdr_process
|dedup action_process_image_name, agent_hostname by desc _time
|comp count() as _count by action_process_image_name, action_process_image_sha256, action_process_signature_vendor
|sort desc _count

Regards,
Ben