topic Re: Check Cortex XDR Agent status in Cortex XDR Discussions

Check Cortex XDR Agent status

Nazlikul — Mon, 05 Jun 2023 12:07:13 GMT

Is it still possible to check the status of Cortex agent in registry? I want to check the status on the client side periodically. I know it is possible via cytool but i need to do this periodically on a lot of computers.

I know there was a way on Traps agent via the registry. Is this still possible or are there any other ways?

Re: Check Cortex XDR Agent status

fmoixsante — Mon, 05 Jun 2023 12:47:34 GMT

Hi @Nazlikul

What would be your use case? Do you have to monitor service uptime? Operational Status? Does the check need to be local? Could the status come from the XDR console? or from the Cortex XDR API?

Re: Check Cortex XDR Agent status

Nazlikul — Tue, 06 Jun 2023 14:12:57 GMT

Hi fmoixsante,

I need to be able to check the operational status. I don't care from where I get the status as long as it is the real operational status,

Thank you

Re: Check Cortex XDR Agent status

fmoixsante — Tue, 06 Jun 2023 17:11:54 GMT

Hi @Nazlikul

You can monitor Operational Status from the All Endpoints section of the Cortex XDR console by using Filters and Layouts.
You could create a XQL query to look for Operational Status and get the result as a table or add a count function to the query
You could create a Dashboard Widget from a XQL query.
You could copy a Dashboard or create a new one and add the built-in widget Agent Operational Status to it.
You could create a Correlation rule from a XQL query and create Alerts whenever there are agents changing operational status to something you want to be alerted on.
You could use the Cortex XDR API or the Cortex XDR XQL API and also gather the Endpoint or Enpoints information from there.
You could use the Cortex XDR XQL API and also gather the Endpoint or Enpoints information from there.

There are many ways to get the Operational Status, but having a defined use case with requirements would be the most recommended way to receive the best answer.

Re: Check Cortex XDR Agent status

Nazlikul — Wed, 07 Jun 2023 12:26:02 GMT

Hi fmoixsante,

What can I see as operational status? is it just connected, disconnected etc. or do I get more information?

Thank you