LIVEcommunity - Who rated this post

Hi @JahidAliyev, thanks for reaching us using the Live Community.

You can try this XQL as an example, and start working from here:

dataset = xdr_data
| filter event_type = ENUM.FILE and event_sub_type = ENUM.FILE_OPEN
| filter actor_process_image_name in ("chrome.exe","edge.exe","firefox.exe")
| fields agent_hostname, agent_ip_addresses,dst_action_external_hostname, action_file_name, action_file_path, action_file_size

dataset = xdr_data | filter event_type = ENUM.FILE and event_sub_type = ENUM.FILE_OPEN | filter actor_process_image_name in ("chrome.exe","edge.exe","firefox.exe")| fields agent_hostname, agent_ip_addresses,dst_action_external_hostname, action_file_name, action_file_path, action_file_size

If this post answers your question, please mark it as the solution.

Who rated this post

L2 Linker

Rating date:

Unlock your full community experience!

Who rated this post