Get fresh insights, pro tips, and thought starters–only the best of posts for you.
To investigate suspicious activity beyond an alert, examine endpoint telemetry to establish what happened, which user was involved, and whether related activity appears on other devices. The Hexnode XDR Investigate Tab provides a workspace for searching and analyzing that activity.
An alert gives analysts a starting point, but an isolated event may leave important questions unanswered. Does the process belong to an approved application? Does the same activity appear elsewhere? These questions shape the investigation.
This walkthrough shows security teams how to build threat-hunting queries, interpret matching events, and save searches for reuse when investigating Windows and macOS endpoints.
Uncertainty about affected endpoints can delay containment decisions or lead analysts to investigate unrelated activity. Without a clear scope, teams struggle to prioritize follow-up work and explain which systems require attention.
The Hexnode XDR Investigate Tab lets analysts query endpoint telemetry to examine activity, identify suspicious patterns, and locate relevant endpoints. Analysts build search conditions using a field, comparator, and value, such as matching a process name to investigate where an executable appeared.
Query results provide evidence, but a match alone does not confirm a threat. Analysts must assess its context before concluding. Investigate supports telemetry analysis, while the Incidents tab provides incident details, technician assignments, and status tracking to support incident response.
The Hexnode XDR agent supplies telemetry from monitored Windows and macOS endpoints. Process, file, network, and endpoint data provide useful context for investigations.
Depending on the platform and available telemetry, examine:
For Windows and macOS investigations, use available telemetry and platform-appropriate executable names and paths. Verify field and event availability before applying the same query across both operating systems.
To build a threat-hunting query in the Hexnode XDR Investigate Tab, establish the investigation scope, construct search conditions, run the query, and interpret the evidence. Follow these steps to move from an initial question to a reusable search.
Start with a specific question: Has the process under investigation appeared on additional endpoints? Record the originating endpoint, the observed process, and the reason for investigating it.
Open Investigate and set the Time Range around the activity under review. Use the known event timestamp as a starting point, allowing enough context to examine relevant activity before and after it.
Confirm that relevant endpoints have the XDR agent and review their connectivity status. Current connectivity alone does not establish whether telemetry exists for the earlier investigation period.
Click inside the search bar and select a field from the available suggestions. Choose a comparator to define how the field should match:
For a value-based condition, enter information observed during the investigation. Use Equal to when you know the complete value. Use partial matching when you need to find values sharing a relevant text pattern, while accounting for unrelated matches.
The completed condition appears as a query bubble. You can edit or delete individual bubbles as you refine the search. Check that each field and value applies to the endpoint activity you intend to investigate.
Connect conditions using AND or OR. AND requires an event to satisfy all connected conditions. OR includes events that satisfy any connected condition.
| Investigation goal | Conditions to combine | Expected matching behavior |
|---|---|---|
| Find a particular process on one endpoint | Process condition AND endpoint condition | Each matching event satisfies both requirements. |
| Search for either of two executable names | First process condition OR second process condition | Each matching event satisfies at least one process condition. |
These examples describe the intended logic; select the corresponding fields and values through the query builder.
Review the conditions before selecting Run Query. An additional AND condition can exclude relevant events when it requires a value they do not contain. Keep each condition tied to the investigation question.
Review the matching records in the results table beneath the search bar. Use the available columns to understand each event:
A match shows that an event satisfies your conditions. Assess the activity’s purpose and surrounding evidence before recommending escalation. For example, an executable’s presence may warrant further investigation, but its name alone does not establish malicious behavior.
Select Export to download the results in CSV, XLSX, or PDF for further analysis or evidence sharing.
Once you have built the query, open Actions > Save Query. Give it a descriptive name and use the optional description to record its purpose, relevant assumptions, and investigation reference.
To reuse it, open Saved Queries and select Add to load its conditions into the search bar. Recent Searches also lets you revisit previously executed queries for further refinement.
Use Share Query to export the query structure for documentation or analyst handoffs. Use Export when you need the matching event results.
Before reusing a search, reassess its values and time window. Investigation notes should help the next analyst understand which assumptions still apply and which conditions need adjustment.
Extend an investigation by using the initial observation to search for related activity on other endpoints. In Hexnode XDR, start with a process value from the existing investigation and follow the evidence through additional questions:
Document the observed activity, relevant endpoints, remaining uncertainty, and next investigative question. Treat a matching filename as a lead that requires context before connecting it to the same incident.
Review the time window, field values, comparators, and logical operators to identify why a query returns insufficient or irrelevant results.
| Query problem | What to check | Suggested adjustment |
|---|---|---|
| Empty results | Spelling and capitalization | Correct typos and match the recorded capitalization. Queries are case-sensitive. |
| Expected activity is missing | Selected time window | Adjust the range to include the activity under investigation. |
| Too few matches | Restrictive AND conditions | Revise conditions that unnecessarily exclude relevant events. |
| Too many unrelated matches | Broad OR conditions or partial matching | Use more specific values, exact matching, or AND when every condition must apply. |
Hexnode documents case sensitivity, time-range checks, and careful use of logical operators as query considerations.
Change one condition at a time, then select Run Query to assess its effect. Zero matches reflect the selected conditions, time window, and available telemetry. They do not establish that an endpoint is free from compromise.
The Hexnode XDR Investigate Tab supports repeatable threat hunting by helping analysts construct searches, revisit earlier work, and share investigation logic.
Evaluate these capabilities using a known observation from your Windows and macOS environment, after confirming the available telemetry for each platform. Can your team investigate the observation, explain what the results establish, and give another analyst enough context to continue the work?
Explore how Hexnode XDR unifies threat visibility, investigation, and response while integrating with Hexnode UEM.
DOWNLOADNo, you can build queries by selecting fields, comparators, and values through the interface. Combine conditions with AND or OR to define which events the search should return.
Reuse depends on whether the query’s fields and conditions apply to the target platform’s available telemetry. Check event coverage, executable names, and paths before applying the query to another operating system.
A saved query preserves search logic, while its results depend on the selected time window and available telemetry. Before comparing two runs, check that their conditions and time windows match, and account for differences in the available records.
Start with one investigation question drawn from your organization’s endpoint activity. Test the search conditions, review the evidence, and identify what you still need to establish. Use the exercise to assess how the Investigate tab fits your team’s approach to threat hunting.
Bring that question to a guided walkthrough. Request a Hexnode XDR demo to explore the Investigate tab using threat-hunting scenarios relevant to your Windows and macOS environment.
Start your free trial and build focused queries with Hexnode Investigate Tab.
Sign Up Now
