LIVEcommunity - Who rated this post

Buy or Renew

dataset = xdr_data
| filter (event_type = 31 and event_sub_type = 10) or (event_type = 15 and action_evtlog_event_id IN (4104)) 
| alter script_data = if (event_type = 15, action_evtlog_message , to_string(dynamic_event_string_map))
| fields agent_hostname, 
    event_type, 
    event_sub_type, 
    actor_process_image_path, 
    actor_process_os_pid, 
    actor_process_image_md5, 
    actor_process_signature_vendor, 
    actor_process_signature_status, 
    actor_effective_username, 
    script_data

You need to find the data you are looking for. Use this xql query to narrow things down.

View solution in original post

Who rated this post

L2 Linker

Rating date:

Unlock your full community experience!

Who rated this post