Hello,
I wish to ask if it's possible to create certain custom queries namely:
1) A query which I can run against the data lake which will show me what machines have certain unwanted applications by comparing the list of windows applications to a name set on the query. Here is the query I used to accomplish this task. unfortunately, my tests indicate that it does not function as intended.
SELECT
meta_hostname AS ep_name,
name,
version,
language,
install_source,
publisher,
identifying_number,
install_date
FROM xdr_data
WHERE query_name = 'windows_programs' and name like '%TORRENT%'
2) Can I get some assistance creating a more robust version of the above query which can be runb against the end points but which will take additional action such as uninstalling the application?
3) Can a query be created which will compare the name of all devices with a sophos agent installed on it which will tell me which devices do not follow a set naming convention?
Thank you very much.
