XQL Query to find bugcheck (BSOD) entries in event logs

[ianatgrafton]

We are experiencing a few BSOD events when auto-upgrade pushes new agents.

Anecdotally, it only seems to happen to a small number of machines and well below 1% of the total XDR estate, however this is anecdotal and I keep getting challenged that "only IT people would report it"

I need to go an investigate how many BSOD events happened in  a particular time frame during the last agent upgrade and I wondered of this could be done with XQL and how I might start

I tried a very simple query using the wizard just looking for events that contain (=~) bugcheck but this brought no results not even the ones I know had an event, so clearly I've misunderstood something here

Any ideas?

[ianatgrafton]

I also tried to use \bbugcheck\b incase it wanted regex in the =~ field

[maximk]

Apparently, I would use agent script execution to collect BSOD events data.