Then run a second query, using
union
so that
the query can access the contents of the
file_event
dataset. Notice that this second query uses the
file_hash
alias that was defined for the
file_event
dataset.
dataset = xdr_data
| filter event_type = PROCESS and event_sub_type = PROCESS_START
| union file_events
| fields agent_id, agent_hostname, file_hash,
actor_process_image_path as executed_by,
actor_process_signature_vendor as executor_signer
| filter file_hash != null and executed_by != null