topic Re: XQL query to find agents seen in the last 30 days in Cortex XDR Discussions

XQL query to find agents seen in the last 30 days

MartinCimone — Mon, 14 Mar 2022 16:20:12 GMT

Hi,

I am looking to create a report that will list all endpoints seen in the last 30 days.

I have created an XQL query that will return all endpoints but I am not able to filter this query to limit the scope to agents that have been seen in the last 30 days ONLY.

-------------------------------

config case_sensitive = false
| dataset = endpoints
| fields endpoint_name , endpoint_type , endpoint_status , last_seen

--------------------------------

Does anyone know how I can achieve this?

Thanks.

#Cortex XDR

Re: XQL query to find agents seen in the last 30 days

tyler_bailey — Mon, 14 Mar 2022 17:11:22 GMT

See if this query gets what you are after.

config case_sensitive = false

| dataset = endpoints
| fields endpoint_name , endpoint_type , endpoint_status , last_seen
| alter last_seen_days = timestamp_diff(current_time(), last_seen, "DAY")
| filter last_seen_days <= 30

Re: XQL query to find agents seen in the last 30 days

MartinCimone — Mon, 14 Mar 2022 17:20:23 GMT

Working like a charm ... ! Thanks @tyler_bailey

Re: XQL query to find agents seen in the last 30 days

NitinYadav — Wed, 22 Feb 2023 04:05:07 GMT

Hi Can you suggest on below cmd

| alter last_seen_days = timestamp_diff(current_time(), last_seen, "DAY")

how to use these with an example