xql query for file \ folder name.

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

xql query for file \ folder name.

L1 Bithead

How can I locate a particular file or folder across all endpoints? 
file or folder name : bihmplhobchoageeokmgbdihknkjbknd

Thanks community 

Cortex XDR

2 accepted solutions

Accepted Solutions

L3 Networker

Dear @Prashanta

 

Hope you are doing well, and thank you for reaching out to our live community. From the above query I understand that you would like to search for a file or a folder across the environment. 

 

Please try the query below and see if you are able to get the desired results, thank you. 

 

preset = xdr_file
| filter agent_hostname = "Host_name" // To filter a particular host
| filter action_file_name contains "file.txt" // To find file by file name
| filter (action_file_path contains """test_folder""") //To find the folder by folder name

 

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

View solution in original post

L4 Transporter

Hello,

 

I believe you want to locate the file or path across all endpoints. I am adding my suggestions for the same,

 

File name:

 

preset = xdr_file
|filter action_file_name contains "usage"
|fields action_file_name ,_time , agent_hostname ,agent_ip_addresses ,agent_mac_addresses ,agent_os_type , action_file_path

 

Folder path:

preset = xdr_file
|filter action_file_path contains """test_folder"""
|fields  action_file_path ,_time , agent_hostname ,agent_ip_addresses ,agent_mac_addresses ,agent_os_type , action_file_path

 

By running just "preset = xdr_file" in Query builder, you will see multiple fields. You can modify the filed or join with another tables to get more information and modify the query as per the requirement.

 

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

Ashutosh Patil

View solution in original post

3 REPLIES 3

L3 Networker

Dear @Prashanta

 

Hope you are doing well, and thank you for reaching out to our live community. From the above query I understand that you would like to search for a file or a folder across the environment. 

 

Please try the query below and see if you are able to get the desired results, thank you. 

 

preset = xdr_file
| filter agent_hostname = "Host_name" // To filter a particular host
| filter action_file_name contains "file.txt" // To find file by file name
| filter (action_file_path contains """test_folder""") //To find the folder by folder name

 

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

L4 Transporter

Hello,

 

I believe you want to locate the file or path across all endpoints. I am adding my suggestions for the same,

 

File name:

 

preset = xdr_file
|filter action_file_name contains "usage"
|fields action_file_name ,_time , agent_hostname ,agent_ip_addresses ,agent_mac_addresses ,agent_os_type , action_file_path

 

Folder path:

preset = xdr_file
|filter action_file_path contains """test_folder"""
|fields  action_file_path ,_time , agent_hostname ,agent_ip_addresses ,agent_mac_addresses ,agent_os_type , action_file_path

 

By running just "preset = xdr_file" in Query builder, you will see multiple fields. You can modify the filed or join with another tables to get more information and modify the query as per the requirement.

 

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

Ashutosh Patil

L1 Bithead

Its works. Thank you.

  • 2 accepted solutions
  • 643 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!