Find filename existed on servers

Maybe you can find it in the sophos_file_journal table:

https://docs.sophos.com/central/References/schemas/index.html?schema=endpoint_schema

You will want to use the 

where file = 'baocao.docx'

by default the time only goes back 15 mins unless you use the "time" column to specifiy. 

Note: If the window of time is too large it could hit a CPU limit.

You can use Epoch Converter - Unix Timestamp Converter to get a starting point, e.g. time > 1735257600

FileOtherChanges or FileOtherReads would be the subject for:

SELECT * FROM sophos_file_journal where file like '%.txt' and time > 1735257600

Another option that might work, depending what's in the file is the yara table.

For example, if I want to find all PE files, identified by the MZ magic bytes at the start of a file in a directory and sub-directories I could use an inline YARA rule in the query:

SELECT
path,
matches,
sigrule
FROM yara
WHERE path like 'C:\Program Files\Sophos\%%'
AND sigrule = 'rule inline_detect_pe_mz {
strings:
$mz_marker = { 4D 5A }
condition:
$mz_marker
}';

For example, the results might then be as follows, note the matches column is only for the files that are PE files.

Another option that might work, depending what's in the file is the yara table.

For example, if I want to find all PE files, identified by the MZ magic bytes at the start of a file in a directory and sub-directories I could use an inline YARA rule in the query:

SELECT
path,
matches,
sigrule
FROM yara
WHERE path like 'C:\Program Files\Sophos\%%'
AND sigrule = 'rule inline_detect_pe_mz {
strings:
$mz_marker = { 4D 5A }
condition:
$mz_marker
}';

For example, the results might then be as follows, note the matches column is only for the files that are PE files.

I suppose:

SELECT * FROM file WHERE (path like "C:\%%\baocao.docx" or path like "C:\%%\%%\baocao.docx" or path like "C:\%%\%%\%%\baocao.docx")

Would search the file system for the file in the top 3 directories without reading the file but for the future if you wanted to perform analysis on the file, the yara table could offer more, for example:

SELECT
path, matches
FROM yara
WHERE (path like "C:\%%\baocao.docx" or path like "C:\%%\%%\baocao.docx" or path like "C:\%%\%%\%%\baocao.docx")
AND sigrule = 'rule inline_detect_pk {
strings:
$pk_marker = { 50 4B }
condition:
$pk_marker
}' and count = 1

This would find all files with that name in the first 3 top level directories and also give you the ability to match on other file data.