xql query for process

[T.Nurmi]

Hi. i just try to do some basic threat hunting. 

dataset = xdr_data
| filter action_process_image_name in ("a.exe", "b.exe")
| fields agent_hostname, actor_effective_username, action_process_image_name, action_process_image_command_line , _time
| sort desc _time

so i try to identfied two different process is happening at same endpoints. how to do that . current query just collect all process and i just want fiter that if those process happen> then i got event> example Process chrome start some other process

[eluis]

Hi @T.Nurmi 

Im not sure what you mean here. 

Are you looking for parent/child process ? 

Two different independent processes ? 

As per your question if those processes happen, I can tell you that if you get data from a process in a query, this means that the logs are there so the process was present there 

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". 

Thank you.

Luis