XDR Features EAP

Discussions Questions on use cases and frequently used queries

XDR Features EAP requires membership for participation - click to join

Questions on use cases and frequently used queries

Jack L over 4 years ago

Hi everyone, I just have some questions on what queries you are using and what are you using them for.

From the list of queries in the query packs, what are the ones you are using on a frequent basis?

What are you using the queries for and to do what?

Are you using them for IT operations, threat hunting, vulnerability management, etc.?

What are some queries that are missing from the packs and you would like more of?

Parents

0 Victor Domingo over 3 years ago
When I run a data lake query, I am missing computers
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Kevin Kingston over 3 years ago in reply to Victor Domingo

Do you want to share some detail on the queries you are referring to and the results you are seeing? Also keep in mind you should only see results for devices that are enrolled into the XDR and EDR Data Lake early access programs. One other thing to call out is that some of the queries only send data if they are seeing something suspicious we are looking for. Any more detail you can share would be great.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 Kevin Kingston over 3 years ago in reply to Victor Domingo

Do you want to share some detail on the queries you are referring to and the results you are seeing? Also keep in mind you should only see results for devices that are enrolled into the XDR and EDR Data Lake early access programs. One other thing to call out is that some of the queries only send data if they are seeing something suspicious we are looking for. Any more detail you can share would be great.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

No Data