xql query for file \ folder name.

[Prashanta]

How can I locate a particular file or folder across all endpoints? 
file or folder name : bihmplhobchoageeokmgbdihknkjbknd

Thanks community 

Cortex XDR

[abdrahman · Accepted solution]

Dear @Prashanta, 

Hope you are doing well, and thank you for reaching out to our live community. From the above query I understand that you would like to search for a file or a folder across the environment. 

Please try the query below and see if you are able to get the desired results, thank you. 

preset = xdr_file
| filter agent_hostname = "Host_name" // To filter a particular host
| filter action_file_name contains "file.txt" // To find file by file name
| filter (action_file_path contains """test_folder""") //To find the folder by folder name

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

[aspatil · Accepted solution]

Hello,

I believe you want to locate the file or path across all endpoints. I am adding my suggestions for the same,

File name:

preset = xdr_file
|filter action_file_name contains "usage"
|fields action_file_name ,_time , agent_hostname ,agent_ip_addresses ,agent_mac_addresses ,agent_os_type , action_file_path

Folder path:

preset = xdr_file
|filter action_file_path contains """test_folder"""
|fields  action_file_path ,_time , agent_hostname ,agent_ip_addresses ,agent_mac_addresses ,agent_os_type , action_file_path

By running just "preset = xdr_file" in Query builder, you will see multiple fields. You can modify the filed or join with another tables to get more information and modify the query as per the requirement.

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

[Prashanta]

Its works. Thank you.