01-15-2025 09:09 AM
Hello @Malayamarutham ,
Thanks for reaching out on LiveCommunity!
You can try below query as a sample and modify it as per your requirement:
dataset = xdr_data
| filter event_type = File and event_sub_type in (ENUM.FILE_CREATE_NEW , ENUM.FILE_WRITE, ENUM.FILE_RENAME ) and (action_file_path contains """\\Downloads\\""" or action_file_path contains "/Downloads/")
| fields actor_process_image_name, agent_hostname, actor_effective_username, event_type, event_sub_type, action_file_name, action_file_path, action_file_extension, action_file_sha256
If you feel this has answered your query, please let us know by clicking on "mark this as a Solution".
Thank you.
