Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 1 reply
  • Subscribers 13 subscribers
  • Views 1279 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Where can we get help for XDR Queries?

LHerzog

Hi,

it there a better place for discussing about Live or Data Lake Queries than the "Live Discover & Response Query Forum"?

There is not much resoponse there. Or should I contact support for special questions?

Regards



This thread was automatically locked due to age.
  • 0

    Hello LHerzog,

    The Live Discover & Response Query forum is the best place to inquire. I had a chance to look into the question you posed, but it looks like data on xlsm and docm files is not hydrated into the table "access_productivity_documents." 

    I am inquiring with my team to verify this first, but I will follow up on this thread to let you know. 

    In general, the information accessible via Live Discover queries will be greater than that of Data Lake queries. Unless the Data Lake hydration process already gathers the information you're trying to see, the two may not report back with the same information.

    I will inquire with our team to see if there’s any way we can fulfill your request. 

    Kushal Lakhan
    Team Lead, Global Community Support
    Connect with Sophos Support, get alerted, and be informed.
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  - Visit Sophos Techvids
Unfiltered HTML