Filtering by Endpoint groups

tfoley — Fri, 05 Mar 2021 12:41:10 GMT

I am trying to write an XQL query that will only focus on the endpoints that I have defined in my endpoint groups and not all endpoints in the xdr_data dataset.

How can I filter the xdr_data dataset by endpoint groups?

Re: Filtering by Endpoint groups

jcandelaria — Mon, 15 Mar 2021 18:20:16 GMT

@tfoley

the endpoint group is not yet available/expose in our XQL xdr data fields

topic Re: Filtering by Endpoint groups in Cortex XDR Discussions

Filtering by Endpoint groups

Re: Filtering by Endpoint groups