HostInfo collector

The HostInfo collector shows a device's hostname, physical IP address, and operating system version.

Collector output

Field	Type	Description
hostname	String	The device's hostname
ip_address	IP	The device's physical IP address
os	String	The device's operating system version.
connection_status	String	Displays the device's status of Quarantined or Online
platform	String	The device's operating system (Windows, macOS, Linux)

Example: Find all devices with Windows operating system.

HostInfo where HostInfo os contains "Windows"

Who are the active users in my enterprise

HostInfo hostname
    AND InteractiveSessions userid, name
        WHERE InteractiveSessions userid not equals ""
            AND InteractiveSessions name not equals ""

Where has user JDOE logged-in

HostInfo hostname
    AND InteractiveSessions userid, name
        WHERE InteractiveSessions userid equals "jdoe"

Find if a list of users logged-in to one target PC

HostInfo hostname
    AND InteractiveSessions userid, name
        WHERE HostInfo hostname equals "PC1"
            AND InteractiveSessions userid equals "jdoe"
                OR InteractiveSessions userid equals "alice" 
                OR InteractiveSessions userid equals "bob"

Show me all logins to one target PC

HostInfo hostname
    AND InteractiveSessions userid, name
        WHERE HostInfo hostname equals "PC1"
            AND InteractiveSessions userid equals "jdoe"
                OR InteractiveSessions userid equals "alice" 
                OR InteractiveSessions userid equals "bob"

Show me all Logins to one Target PC

HostInfo hostname
    AND InteractiveSessions userid, name
        WHERE HostInfo hostname equals "W10-LATEST"
            AND InteractiveSessions userid not equals ""

Show me all logins to many target PCs

HostInfo hostname
    AND InteractiveSessions userid, name
        WHERE HostInfo hostname equals "PC1"
            OR HostInfo hostname equals "PC2"
            OR HostInfo hostname equals "PC3"

Discover which systems have extensions installed - single

HostInfo hostname
   AND Files created_at, last_write, name
      WHERE Files full_name contains "hddjhjcbioambdhjejhdlobijkdnbggp"

Discover which systems have extensions installed - many

HostInfo hostname
   AND Files created_at, last_write, name
      WHERE Files full_name contains "hddjhjcbioambdhjejhdlobijkdnbggp"
         OR Files full_name contains "efaidnbmnnnibpcajpcglclefindmkaj"
         OR Files full_name contains "jlhmfgmfgeifomenelglieieghnjghma"

Confirm a chrome manifest file is present

HostInfo hostname
   AND Files created_at, last_write, name
      WHERE Files full_name contains "hddjhjcbioambdhjejhdlobijkdnbggp"
         OR Files full_name contains "efaidnbmnnnibpcajpcglclefindmkaj"
         OR Files full_name contains "jlhmfgmfgeifomenelglieieghnjghma"
            AND File name equals "manifest.json"

Discover number of systems and versions of the target software

HostInfo hostname
    AND Software installdate, publisher, version, displayname
        WHERE Software displayname contains "zoom"

Discover source locations used to download the target software

HostInfo hostname
    AND BrowserDownload referrer, site_url, mime_type, browser, user_profile
        WHERE BrowserDownload file_path contains "zoom"

Get some hashes, might be good for app control

HostInfo hostname
    AND BrowserDownload referrer, site_url, mime_type, browser, user_profile
        WHERE BrowserDownload file_path contains "zoom"