Cortex XDR unmanaged assets search with XQL

Retired Member — Wed, 24 May 2023 16:30:08 GMT

Hello Everyone,

I have a following question: Since XDR agents are able to detect unmanaged assets in their network (without Broker VM), how can I get that information via XQL ?

Any information will be usefully.

Thank you

Re: Cortex XDR unmanaged assets search with XQL

PiyushKohli — Thu, 25 May 2023 04:23:23 GMT

Hi @Retired Member

For your use case to detect unmanaged assets in network (without Broker VM), if those endpoints are domain joined you can leverage the Cloud Identity Engine dataset (pan_dss_raw) to cross-reference the data with endpoints data to identify assets which are a part of the organization domain but are not in the endpoints dataset.

XQL query for reference:

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

topic Cortex XDR unmanaged assets search with XQL in Cortex XDR Discussions

Cortex XDR unmanaged assets search with XQL

Re: Cortex XDR unmanaged assets search with XQL