topic Cortex XQL Query in Cortex XDR Discussions

Cortex XQL Query

KarlHalpin — Tue, 26 Jul 2022 14:19:42 GMT

Hi Guys,

Sort of new to XDR does anyone have any good xql queries for detecting assets without cortex agents installed and if the cyserver service has stopped working?

Thanks

Re: Cortex XQL Query

WSeldenIII — Tue, 26 Jul 2022 21:00:07 GMT

Hi @KarlHalpin The Agent Service is captured in the Agent Audit Logs. The agent audit logs are not currently exposed as a dataset in ordered to be queried utilizing XQL. The agent audit logs are able to be exported to file or you may to configure notification forwarding to support your monitoring needs.

From an XQL enablement standpoint, there is a new feature to Pause Endpoint Protection that requires the Cortex XDR agent 7.7 and above, which is apart of the Endpoints dataset; therefore, you can leverage XQL. Please reference the following example query:

dataset = endpoints |filter manual_protection_pause = "PROTECTION_PAUSED"

The results from this XQL query will display only endpoints that are configured with the XDR agent and have the endpoint protection manually paused.

Re: Cortex XQL Query

bbarmanroy — Wed, 27 Jul 2022 06:59:42 GMT

To add onto what @WSeldenIII stated for endpoints without XDR, you can achieeve the same with Network Mapper.

Alternately, you can look at integrating Cloud Identity Engine and compare the assets with endpoints dataset and identify the assets that do not appear in both datasets with XQL.