Hi RFeyertag, As it relates to process events collected, XDR logs the start and stop actions. So building off of what @mfakhouri provided, you could add filtering to remove any process start event that also has an existing process stop event for the same time period, based off of the process ID (see example query below), so in theory, the remaining logs are process instances that have been started but not stopped for the given time window. One other thing to keep in mind is the extract_time function is going to return a value in UTC, so when adding your filtering conditions you would want to keep that in mind to make sure the values you define match up to your organizations work hours. Example:
dataset = xdr_data
|filter event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START
| alter timeOfDay = extract_time(_time, "HOUR")
| filter timeOfDay < 9 or timeOfDay > 17
//Using the "not in" operator, I have defined almost the exact same query as above, except changed the event_sub_type to "stop". So this filter will only return events for process ID's that don't have a corresponding process stop event. |filter action_process_os_pid not in(dataset = xdr_data|filter event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_STOP| alter timeOfDay = extract_time(_time, "HOUR")| filter timeOfDay < 9 or timeOfDay > 17 |fields action_process_os_pid)
| fields agent_hostname, agent_ip_addresses, action_process_image_path
Regards, Ben
... View more
