The VMware Carbon Black Tech Zone is live! Checkout this great resource: Mastering Carbon Black Audit & Remediation.

Search Download Folders for ISO downloads

Description: This query searches the downloads folder of all computers looking for .iso files. Can be changed to any file type or folder also. 

What The Data Shows: Device, File if found, location if found

SQL:

Select *
FROM FILE
Where file.path like 'C:\users\%\Downloads\%%'
AND file.filename like '%.iso'

 

Tags (2)
2 Comments
jnelson
Carbon Black Employee

Sorry for the delay in reviewing your submission! I will approve it shortly, but the use of "file." on path and filename is not necessary because you are only using one table.

jnelson
Carbon Black Employee
Status changed to: Approved