topic Linux operation mode (Pending) in Cortex XDR Discussions

Linux operation mode (Pending)

VenuK — Mon, 20 Mar 2023 04:42:58 GMT

Dear All,

I wanted to create a widget to display the details of Linux Operation Mode, can someone help me how I can start with, I am still a rookie in XQL Query.

TIA

Re: Linux operation mode (Pending)

neelrohit — Mon, 20 Mar 2023 08:48:44 GMT

Hi @VenuK

Thank you for wiritng to live community!

The endpoints dataset for XQL gives us the details on Linux operation mode.

Hence if you query by the following:

dataset=endpoints
| filter platform = ENUM.LINUX
| fields endpoint_name, endpoint_status, Linux_operation_mode

You can add more fields as per your choice

Hope this helps!

Re: Linux operation mode (Pending)

VenuK — Mon, 20 Mar 2023 08:54:35 GMT

Hi @neelrohit , thank you for the example, let me use the query and develop my requirement and share you with the end result.

Re: Linux operation mode (Pending)

VenuK — Mon, 20 Mar 2023 09:17:47 GMT

@neelrohit I am able to meet the requirement with the below one. Thank you for helping me to start off with.

dataset = endpoints
|filter platform = ENUM.LINUX
|filter endpoint_status = ENUM.CONNECTED or endpoint_status = ENUM.DISCONNECTED
|fields endpoint_name, endpoint_id, endpoint_status
|comp count(endpoint_name) as tally by endpoint_status
|view graph type = pie subtype = full xaxis = endpoint_status yaxis = tally