Run osquery task

Procedure

1. In the Trend Vision One console, go to XDR Threat Investigation → Forensics.
2. Click the name of the workspace that has the endpoints you want to triage.

   Note This task automatically adds all collected evidence to the workspace.

3. Select one or more endpoints from the list. Selected endpoints must all use the same operating system.
4. Click Run osquery.

   Note You can also run this response task from the context menu in the Trend Vision One Search app.

   The Run osquery Task window appears.
5. Configure the task.
   1. Use the radio buttons either to select an existing SQL query or to input a new query.
      • Choose Select a query: Click Select a query, select an existing query, and click Continue.
        To add a new query to the selection list, go to osquery on the Response Scripts tab of Response Management. Click Add query to select an operating system, type a new query, and validate the query syntax.
      • Choose Input a query: Type a query and click Validate query.

        Tip Use Companion to generate osquery queries by clicking Generate osquery Query ().

   2. Specify a Description for the response or event.
   3. Click Create.
   4. In the Multi-factor authentication (MFA) required window, paste the verification code and click Submit.
      If authentication succeeds, the task appears in the Response Management Task List.

      Tip For response tasks created from the context menu in the Search app, click the View details in Forensics icon () in the Response Management Task List to go directly to Forensics → Query Results.

6. Monitor the task status.
   1. In the workspace that has the endpoints you are triaging, click View Query Results
   2. Select osquery.
   3. Locate the task using the Task name menu.
   4. View the task status.
      • In progress (): Trend Vision One sent the command and is waiting for a response.
      • Queued (): The managing server queued the command because the agent was offline.
      • Successful (): The command was successfully executed.
      • Unsuccessful (): An error or time-out occurred when attempting to send the command to the managing server, the agent is offline for more than 24 hours, or the command execution timed out.
   5. If the task is successful, click the icon to open the Download File window, copy and retain the password, and click Download to obtain the task archive file.