XQL - list of processes, which were not started/launched in the last XX days

[RFeyertag]

Hello dear community, 

I would like to have a list of processes which were not started/launched in the past XX days. I think it would be nice to know, which processes are brand new etc.

Will this work with XQL and how?

BR

Rob

[mavega]

Hi RFeyertag,

Thanks for reaching out to our live community.

We are looking into your inquiry and doing some research to provide you with the best possible response.

Could you please elaborate a bit more? What is the use case for your inquiry?

Please provide as many details as possible as there might a better approach on gathering the information you are looking for.

[RFeyertag]

Hello @mavega,

this would help us in the part "malware flew under the radar". We also see the rare processes in the company and can investigate deeper, if we want. 

Thanks for your research!

BR

Rob

[mavega]

Hi RFeyertag,

We are still looking into this one, not sure Cortex works that way, but if you have Host Insight add-on maybe you can try the below script, it might not provide the non running processes but it will show the state of them and you might be able to sort them out (script is for 30 days but you can change it):

preset = host_inventory_services 
| alter More_Than_30D = if((timestamp_diff(current_time(),report_timestamp  ,"day")>=30) , "True", "False")
| filter (More_Than_30D != """False""") 
| filter started = "false"
| fields  service_name ,report_timestamp , More_Than_30D , service_state , service_type , endpoint_name , started 
| dedup service_name