topic Re: Query to Monitor Computer Uptime in Cortex XDR Discussions

Query to Monitor Computer Uptime

Melvin_Machado — Mon, 22 Jan 2024 13:51:52 GMT

Hello,

I intend to formulate a new query to retrieve the computer's uptime, and if the system has been active for more than 30 days, generate an alert. Although I attempted the following XQL Search, the outcome yielded no results:

config case_sensitive = false
| preset = xdr_event_log
| filter event_type = EVENT_LOG and action_evtlog_event_id in (6013)
| fields action_evtlog_message as message, action_evtlog_event_id as event_id

Can u help me, please

Re: Query to Monitor Computer Uptime

PC-TomS — Mon, 22 Jan 2024 19:02:30 GMT

Have you confirmed that the system uptime field is populated for any endpoints?

None of our 4000+ endpoints show values in that field and I posted this question in December.

The response was it is only for iOS devices.

LIVEcommunity - System uptime field for Cortex Pro agents is empty. - LIVEcommunity - 568917 (paloaltonetworks.com)

Re: Query to Monitor Computer Uptime

Melvin_Machado — Thu, 25 Jan 2024 15:29:59 GMT

We have different inquiries and issues ;

While you utilize an add-on named "Host Insights" to retrieve your machine's uptime, someone mentions that it's not feasible because it's solely accessible for iOS
On my end, what I aim for is to extract the description of event 6013 from the event log using an XQL Search. If the value within the description exceeds 2,592e+6, I want to trigger an alert