How to check powershell version at cortex XDR

[G.Cai500031]

Hi everyone,

I'm a beginner of Cortex XDR.

I need to confirm what devices have older versions of powershell installed and when I search for apps named powershell using host inventory I can only get 300+ results for powershell 7.

I changed some keywords, i seems all other versions below powershell 7 are not searchable.

And I tried to use query builder to find files named powershell I could find more than 8000 results, apparently cortex is able to find older versions of powershell I just don't know the right way to do it.

Cortex XDR  

[aspatil · Accepted solution]

Hello @G.Cai500031 ,

You may try below:
dataset = host_inventory
| filter applications != null
| arrayexpand applications
| alter app_name = json_extract(applications, "$.application_name"),
app_version = json_extract(applications, "$.version")
| filter app_name contains "powershell"
| filter app_version < "7"
| fields host_name, app_name, app_version
| sort asc host_name

If you feel this has answered your query, please let us know by clicking like and  on "mark this as a Solution". Thank you.

[G.Cai500031]

Hi Aspatil,

Thank you for your reply.

I tried these commod but can only find 285 results.

It seems in the data set of host invebtory only have powershell 7 's information..

[aspatil]

There is a filter applied to display versions less that 7. You can modify it as per your requirement.

[G.Cai500031]

I do use the filter. But no result found.

It seems Cortex didn't collect all the information.

Anyway, thank you for your answer. 🙂