Using XDR Host Insights and XQL to report of machines with specific software

[GarethDavies]

Hello All

I would like to use host insights to provide a list of each machine with a specific software installed.

For example computer that have software containing 'docker'

I can go to host insights, Applications, filter to include 'docker' and see the versions and numbers of assets. however you cannot export the lost of each asset here, just the versions and numbers.

I am new to XQL and have not managed to create a query for the host_inventory dataset. 

[bbarmanroy · Accepted solution]

Hi @GarethDavies Does the query below aid you? 

config case_sensitive = false timeframe=365d 
| dataset = host_inventory 
| filter applications != null
| arrayexpand applications
| alter applications=json_extract(applications, "$.application_name")
| filter applications contains "docker"
|fields applications, ip_addresses, host_name

[GarethDavies]

Hello Thank you 

that solution will work and gives me the raw output that I can investigate further , I see I can add more fields that I may want in the last line 

[huwang]

Hi Bbarmanroy，thank you for sharing. I try to output more fields, such as the application version, but it doesn't work. Look forward to your suggestions.

config case_sensitive = false timeframe=365d
| dataset = host_inventory
| filter applications != null
| arrayexpand applications
| alter applications=json_extract(applications, "$.application_name")
| alter version=json_extract(applications, "$.raw_version")
|fields applications, ip_addresses, host_name, version

[bbarmanroy]

Hi @huwang use version instead of raw_version.