XQL Query to list top process causing issues

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

XQL Query to list top process causing issues

L2 Linker

Dear All,


I would like to know how to build a query to troubleshoot issues on a host where I wanted to list the processes running on the host and also to identify which is causing the issue. I am writing the below query to find no details, please help.


preset = xdr_process
| filter agent_hostname contains "Host1" or agent_hostname contains "Host2"


Thank you all in advance.


L3 Networker

Hi @VenuK 

You should consider XQL queries is like event based queries. 

If process start and stops, You'll have an event data and that data 'll be queriable by XQL. 

But you cannot get current status with XQL.(like which process is actively working)

Potentially, Still you can write a heavy query and get all executed process in last 24 hours and if process has not ended you can list but what if process executed more than 24 hours a go ?

Best way to get that data is using "Action Center" > "Run Endpoint Script" > "Process get"

This script'll list active processes which is working on the endpoints. 



  • 1 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!