From the Query Builder you can perform a simple search for hosts and processes across all file events, network events, registry events, process events, event logs for Windows, and system authentication logs for Linux.
Some examples of queries you can run across all entities include:
All activities on a host
All activities initiated by a process on a host
To build a query:
From Cortex XDR , select → .
Select ALL ACTIONS.
(Optional) Limit the scope to a specific acting process:
Select, and specify one or more of the following attributes for the acting (parent) process. Use a pipe (|) to separate multiple values. Use an asterisk (*) to match any string of characters.Table 3.
Name of the parent process.
Path to the parent process.
Command line used to initiate the parent process including any arguments, up to 128 characters.
MD5 hash value of the parent process.
SHA256 hash value of the process.
User who executed the process.
Signing status of the parent process: Signed, Unsigned, N/A, Invalid Signature, Weak Hash.
Entity that signed the certificate of the parent process.
Process ID of the parent process.
Run search on process, Causality and OS actors
The causality actor, also referred to as the causality group owner (CGO), is the parent process in the execution chain that the agent identified as being responsible for initiating the process tree. The OS actor is the parent process that creates an OS process on behalf of a different initiator. By default, this option is enabled to apply the same search criteria to initiating processes. To configure different attributes for the parent or initiating process, clear this option.
(Optional) Limit the scope to an endpoint or endpoint attributes:
Selectand specify one or more of the following attributes:
address, , or
can be either an agent, or data collector.
, or .
Use a pipe (|) to separate multiple values. Use an asterisk (*) to match any string of characters.
Specify the time period for which you want to search for events.
Options are(hours), (days), (month), or select a Custom time period.
Choose when to run the query.
Select the calendar icon to schedule a query to run on or before a specific date orthe query immediately and view the results in the .
While the query is running, you can always navigate away from the page and a notification is sent when the query completes. You can also Cancel the query or run a new query, where you have the option to Run only new query (cancel previous) or Run both queries.
When ready, view the results in a query.