Press CTRL+K to open search

HostEntries collector

  • Published on Sep 3, 2026
  • 1 minute(s) read
Prev Next

The HostEntries collector shows the IP addresses and host names from hosts file on Windows, Linux, and macOS devices.

Collector output

Field

Type

Description

ipaddress

IP

An IP address set in the hosts file.

hostname

String

The host name mapping for the IP address.



Supported versions

Windows

Linux

macOS

3.0 and later

3.0 and later

3.0 and later



Example: Find devices whose hosts file configures access to www.malware.com.
HostEntries where HostEntries hostname equals "www.malware.com"


Related articles
  • HostEntries collector
    Endpoint Detection and Response with Forensics (EDRF) > Investigate potential threats with EDRF > Conduct searches > Search real-time data of endpoints for investigation and threat hunting > Collecting device data for real-time search > Built-in collectors
  • HostInfo collector
    Endpoint Detection and Response (EDR) > Endpoint Detection and Response Product Guide > Collecting device data for real-time search > Built-in collectors
  • HostInfo collector
    Endpoint Detection and Response with Forensics (EDRF) > Investigate potential threats with EDRF > Conduct searches > Search real-time data of endpoints for investigation and threat hunting > Collecting device data for real-time search > Built-in collectors