XQL question command line with " to XQL query

[RFeyertag]

Hello dear community, 

is there a way to put the whole command line into the XQL query? As you can see the doublequotes are already set by the command line itself. 

In SQL I know to do it whith extra double quotes ""XYZ"". But how does that work with XQL?

BR

Rob

[bbarmanroy]

@RFeyertag yes you can. Use an leading '\' escape character.

[RFeyertag]

Sorry, I don't get it. 

How would you type in, if i want to check exactly following string. 

"C:\Windows\System32\hh.exe" C:\Program Files (x86)\ASSA ABLOY\Vision\Vision.chm::/Use_Guest_CheckIn_Steps_Single.htm

BR

Rob

[SilviuMihailDascalu]

Just like @bbarmanroy mentioned in the post you just need to escape the double quotes in the string.

dataset = xdr_data
|filter action_process_image_command_line = "\"C:\Windows\System32\hh.exe\" C:\Program Files (x86)\ASSA ABLOY\Vision\Vision.chm::/Use_Guest_CheckIn_Steps_Single.htm"
|fields action_process_image_command_line