To find the hashes of the applications through XQL search

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

To find the hashes of the applications through XQL search

L0 Member

Hi team,

is there a query to get the hashes of the applications installed in host inventories or any other way ?


L3 Networker

Hi Pv_anayaa,

The list of applications collected by host-insights and displayed in the XDR UI or via XQL does not include hashes. Hashes are calculated and collected for process execution events however, so while the query below would not give you a comprehensive list of installed applications with their hashes, it will show you what processes/applications have been run during the defined timeframe, and includes their hashes. You could then use XQL to create a custom dataset with this data, and schedule a query to append the custom dataset anytime a new process name is seen.

preset = xdr_process
|dedup action_process_image_name, agent_hostname by desc _time
|comp count() as _count by action_process_image_name, action_process_image_sha256, action_process_signature_vendor
|sort desc _count


  • 1 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!