Yes. There are multiple workarounds. 1. You can either use the "Endpoint Administration" Tab to get the equivalent "hostname" of the "IP Address"/"user" and then use "quick Launcher" on the top right to get the "Asset View" of the endpoint Change the view to applications. That provide the list of application and the count 2. Alternatively, you can use XQL query. Target "Host Inventory" table Note: Agent_id is the primary key for the host inventory table. But you can execute the query with a filter such as - host_name - ip_addresses - users Also, note the timeframe specified because host inventory collection happens daily and you could have multiple counts With IP Address dataset = host_inventory | filter ip_addresses = "10.10.10.10" | arrayexpand applications | alter apps = json_extract(applications, "$.application_name") | fields apps To make it a re-usable query, change the hardcoded IP Address to "$system_ip" and save it into your query library Whenever you want to use the query, you will need to supply the target IP Address as the parameter. See attached screenshot dataset = host_inventory | filter ip_addresses = "$system_ip" | arrayexpand applications | alter apps = json_extract(applications, "$.application_name") | fields apps With User name change the target_user e.g. Smith (case sensitive) dataset = host_inventory | arrayexpand users | alter target_user = json_extract(users, "$.name") | filter (target_user = "\"target_user\"") | arrayexpand applications | alter apps = json_extract(applications, "$.application_name") | fields apps For the count of applications per IP Address dataset = host_inventory | filter ip_addresses = "10.10.10.10" | arrayexpand applications | alter apps = json_extract(applications, "$.application_name") | dedup apps by asc _time | comp count(apps) as Counter by _time
... View more
