topic Re: Difference between host_inventory and endpoint in XQL Query in Cortex XDR Discussions

Difference between host_inventory and endpoint in XQL Query

RemiLiquete — Thu, 31 Aug 2023 15:10:39 GMT

Hello,

I'm trying to search for all installed vpn on endpoints using an XQL Query.

Before going further in my query, I'm trying to list all hosts where the application name contains "*vpn*".

This result and the result from host insight doing the same search are different. Somes endpoints are not showing in the query. So I've tried to search for those missing endpoints in query. I only find them when using the dataset "endpoints". I can't find them using host_inventory.
Why?

Re: Difference between host_inventory and endpoint in XQL Query

nsinghvirk — Thu, 31 Aug 2023 17:32:41 GMT

Hello @RemiLiquete

Thanks for reaching out on LiveCommunity!

Possible reason for not getting same number of hosts in endpoint and host_inventory dataset can be that the host insight capability was not enabled for all the hosts in agent setting profile. Other possible reason can be that you have limited number of Host Insight licenses which are required for host_inventory to work. Hence you may be missing out data from some of the hosts in host_inventory dataset.

Re: Difference between host_inventory and endpoint in XQL Query

RemiLiquete — Fri, 01 Sep 2023 08:11:48 GMT

Hello @nsinghvirk

Thank you for your answer!

You're right, this is a licenses problem; I didn't check that.

Re: Difference between host_inventory and endpoint in XQL Query

RFeyertag — Tue, 12 Sep 2023 16:16:22 GMT

Hey @RemiLiquete,

please set me know if you also have the problem to get them inside host inventory when your licence issue is solved.

In my opinion you have to reinstall the agent, because I have severall clients which are not visible in the host inventory after license upgrade.

Rob

Re: Difference between host_inventory and endpoint in XQL Query

RemiLiquete — Wed, 13 Sep 2023 15:20:56 GMT

Hello, thank you for the information.
For now, I did not resolve this issue since it's not impacting for now. I let you know if it changes.

Re: Difference between host_inventory and endpoint in XQL Query

RFeyertag — Wed, 13 Sep 2023 20:42:27 GMT

You're welcome!

Maybe you have more visibility with this XQL:

config case_sensitive = false
| dataset = endpoints
|join conflict_strategy = both type = left (dataset = host_inventory ) as HI HI.host_name = endpoint_name and HI.agent_domain = domain
|fields domain , endpoint_name, last_seen, host_name, endpoint_status
|filter host_name = null
|sort desc last_seen