Status of Disabled Cortex XDR Agent

RamyashreeMada — Sat, 01 Oct 2022 13:56:26 GMT

Hello,

We are planning to create a dashboard and report to check if the Cortex agent is disabled on endpoints and servers.

We attempted to create but were unsure which template to use. Could you please assist us with this?

Re: Status of Disabled Cortex XDR Agent

mavraham — Sun, 02 Oct 2022 18:23:56 GMT

Hi RamyashreeMada!

My suggestion would be to start with a report template by going into Dashboards & Reports->Customize ->Dashboards Manager->+ New Template. There you should find the 'Agent Management Report' template along with an Agent Status Breakdown (attached screenshot for your continence) presenting the number of connected and disconnected agents.

Next, you can use the XQL query below to create a new widget displaying Agents which are disconnected or have lost their connection:

dataset = endpoints | filter endpoint_status = CONNECTION_LOST or endpoint_status = DISCONNECTED

After you've finished creating the widget, you can add it to your custom report/dashboard.

Hope this helps!

topic Status of Disabled Cortex XDR Agent in Cortex XDR Discussions

Status of Disabled Cortex XDR Agent

Re: Status of Disabled Cortex XDR Agent