Browse Live Discover and Response Queries by Category
Approved

NOTE: Answer in comments

How can I adjust this query so that it uses a list of items instead of just one file?

I assume that searching for a list of files at once would be faster than searching for each file individually.

So, how can I adjust this query so that it uses a list of items instead of just one file?

---

Descriptive name  Variable type  SQL Variable       Value

-----------------------  -----------------  ------------------       -------------------

FileName               String            $$FileName$$  =  Virus.txt
FilePath                 String            $$FilePath$$     =  \Users\%\Downloads\%%


SELECT
path,
directory,
filename,
device,
size
FROM file
WHERE
(
directory LIKE 'C:$$FilePath$$' AND filename = '$$FileName$$' OR
directory LIKE 'D:$$FilePath$$' AND filename = '$$FileName$$' OR
directory LIKE 'E:$$FilePath$$' AND filename = '$$FileName$$' OR
directory LIKE 'F:$$FilePath$$' AND filename = '$$FileName$$' OR
directory LIKE 'G:$$FilePath$$' AND filename = '$$FileName$$' OR
directory LIKE 'H:$$FilePath$$' AND filename = '$$FileName$$' OR
directory LIKE 'I:$$FilePath$$' AND filename = '$$FileName$$' OR
directory LIKE 'J:$$FilePath$$' AND filename = '$$FileName$$' OR
directory LIKE 'K:$$FilePath$$' AND filename = '$$FileName$$' OR
directory LIKE 'L:$$FilePath$$' AND filename = '$$FileName$$' OR
directory LIKE 'M:$$FilePath$$' AND filename = '$$FileName$$' OR
directory LIKE 'N:$$FilePath$$' AND filename = '$$FileName$$' OR
directory LIKE 'O:$$FilePath$$' AND filename = '$$FileName$$' OR
directory LIKE 'P:$$FilePath$$' AND filename = '$$FileName$$' OR
directory LIKE 'Q:$$FilePath$$' AND filename = '$$FileName$$' OR
directory LIKE 'R:$$FilePath$$' AND filename = '$$FileName$$' OR
directory LIKE 'S:$$FilePath$$' AND filename = '$$FileName$$' OR
directory LIKE 'T:$$FilePath$$' AND filename = '$$FileName$$' OR
directory LIKE 'U:$$FilePath$$' AND filename = '$$FileName$$' OR
directory LIKE 'V:$$FilePath$$' AND filename = '$$FileName$$' OR
directory LIKE 'W:$$FilePath$$' AND filename = '$$FileName$$' OR
directory LIKE 'X:$$FilePath$$' AND filename = '$$FileName$$' OR
directory LIKE 'Y:$$FilePath$$' AND filename = '$$FileName$$' OR
directory LIKE 'Z:$$FilePath$$' AND filename = '$$FileName$$'
)

Brian Dake
Parents

  • Here is another sample query you can add/modify the filename.


    -- Define variable FilePath


SELECT
	path,
	directory,
	filename,
	device,
	size
FROM 
	file
WHERE
	path like '$$FilePath$$'
	and filename IN 
	(
	'file1.txt',
	'file2.jpg',
	'file3.mov',
	'file4.aspx'
	);


Comment

  • Here is another sample query you can add/modify the filename.


    -- Define variable FilePath


SELECT
	path,
	directory,
	filename,
	device,
	size
FROM 
	file
WHERE
	path like '$$FilePath$$'
	and filename IN 
	(
	'file1.txt',
	'file2.jpg',
	'file3.mov',
	'file4.aspx'
	);


Children
No Data
Unfiltered HTML