I would like to know how to build a query to troubleshoot issues on a host where I wanted to list the processes running on the host and also to identify which is causing the issue. I am writing the below query to find no details, please help.
preset = xdr_process
| filter agent_hostname contains "Host1" or agent_hostname contains "Host2"
Thank you all in advance.
You should consider XQL queries is like event based queries.
If process start and stops, You'll have an event data and that data 'll be queriable by XQL.
But you cannot get current status with XQL.(like which process is actively working)
Potentially, Still you can write a heavy query and get all executed process in last 24 hours and if process has not ended you can list but what if process executed more than 24 hours a go ?
Best way to get that data is using "Action Center" > "Run Endpoint Script" > "Process get"
This script'll list active processes which is working on the endpoints.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!