topic Cortex XDR Checkin Time in Cortex XDR Discussions

Cortex XDR Checkin Time

Amnsgna — Tue, 16 May 2023 17:32:55 GMT

Hello All,

Was curious, is there a related registry key for Traps last check-in date? I'm curious if there is an easy way to pull in that information with powershell.

Quick example scenario would be that we would use one script to pull in the last check in time with multiple computers with Cortex XDR.

Thanks!

Re: Cortex XDR Checkin Time

bbarmanroy — Wed, 17 May 2023 08:58:57 GMT

There are a few ways to achieve this in decreasing order of preference to collect the data:

Get the last seen timestamp from XDR API's (Ref: https://cortex-panw.stoplight.io/docs/cortex-xdr/fde2236a93dfe-get-all-endpoints)
Run "cytool last_checkin" on the endpoint (Ref: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.9/Cortex-XDR-Agent-Administrator-Guide/Cytool-for-Windows)

Re: Cortex XDR Checkin Time

Amnsgna — Fri, 19 May 2023 18:54:21 GMT

Hello,

Thank you for the quick reply. That helps a lot. Would it be possible without access to the management console?

Re: Cortex XDR Checkin Time

aleksandar.astardzhiev — Sat, 20 May 2023 19:15:13 GMT

Hi @Amnsgna

The second option suggested by @bbarmanroy - "run cytool last_checkin" is the option "without access to the management console".

Cytool is CLI tool that is installed with CortexXDR agent on each endpoint and can be used to troubleshoot and manage the XDR agent. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/8.0/Cortex-XDR-Agent-Administrator-Guide/Cytool-for-Windows

With this option you need to execute the command on each individual endpoint and check the output.