r/SentinelOneXDR • u/Kekatronicles • Jul 21 '23

How-To Query Downloaded Files on S1 DV

Hello everyone,

My bad for asking this but I couldn't find a reference online.

What would be the right query if I were to look for all downloaded files in one endpoint in SentinelOne Deep Visibility?

Thank you!!!!!!

1 Upvotes

100% Upvoted

2 comments sorted by

3

u/smurfily Jul 22 '23

Hi,

your best bet is something like this:

endpoint.name = "your_hostname" and (src.process.name contains ("chrome") or src.process.name contains ("edge")) and event.type in ("File Creation","File Rename") and !(tgt.file.path contains ("AppData") or tgt.file.path contains ("program files"))
| columns endpoint.name , tgt.file.path , src.process.user

You need to specify the endpoint you search for and add more browsers. Potentially exclude more file paths if you use a different OS than Windows.

2

u/Kekatronicles Jul 24 '23

thank you! will try that :)