export/view information about Windows endpoints missing with KB

haimmiller — Sun, 05 Feb 2023 13:29:54 GMT

Hi,

I'd like to know how I can export/view information about Windows endpoints that do not apply with specific KB by specific ENDPOINT GROUPS. I can only filter by CVES or ENDPOINTS from the Vulnerability Assessment but not with KBs.

My second question is there a way to query if, for example, a Windows endpoint is not applied with the latest cumulative KB/older KBs?

Thanks

Re: export/view information about Windows endpoints missing with KB

neelrohit — Mon, 06 Feb 2023 10:52:34 GMT

Hi @haimmiller ,

Thank you for writing to Live Community!

Cortex XDR vulnerability assessment shows you the list of KBs installed on the endpoints. However, it does not show the comparative analysis or assessment for latest KBs as KBs are provided by the vendors and we do not fetch the latest serials into XDR. However, you can list the KBs in couple of ways as listed below:

Using Script Execution: If you do not have host insights license but have Cortex XDR Pro license enabled on endpoints, you can use the Cortex XDR script execution. Under category of "Execute Commands" you can run the following cmdline params "wmic qfe get HotfixID" you can also use "find" at the end of this command to filter by date/month/year or the latest KB number as per your choice(example below):. You can also get the result output of the script in form of a report.

wmic qfe get HotFixID | find "3004365"

Using host insights based license and XQL: You can use the traditional host insights based dataset to query the list of installed KBs on endpoints using the following XQL query

You can add filters of your choice under this to query the data for specific hostnames and also create a visual graph for the list of KBs as per your choice. (Example screenshot below)

Hope this helps!

Please mark the response as "Accept as Solution" if it was able to resolve your query.

Regards

Re: export/view information about Windows endpoints missing with KB

haimmiller — Mon, 06 Feb 2023 11:29:30 GMT

Thanks for the info. I'll try it.

topic Re: export/view information about Windows endpoints missing with KB in Cortex XDR Discussions

export/view information about Windows endpoints missing with KB

Re: export/view information about Windows endpoints missing with KB

Re: export/view information about Windows endpoints missing with KB