topic Re: XQL to get details of endpoints installed in last 12 hrs in Cortex XDR Discussions

XQL to get details of endpoints installed in last 12 hrs

Shahwaz_Md — Fri, 23 Feb 2024 14:19:24 GMT

Hi Team,

Need to build a report, hence need help with the XQL query to get the endpoints installed in the last 12 hrs.

Regards,

Shahwaz

Re: XQL to get details of endpoints installed in last 12 hrs

jmazzeo — Fri, 23 Feb 2024 14:32:07 GMT

Hi @Shahwaz_Md, thanks for reaching us using the Live Community.

Please try this query, you can change or add the fields as you need:

dataset = endpoints | filter timestamp_diff(current_time(),first_seen,"hour")<=12 | fields endpoint_name, operating_system, os_version , agent_version , content_version, user , ip_address

Let me know if this works. Thanks

Re: XQL to get details of endpoints installed in last 12 hrs

Shahwaz_Md — Fri, 23 Feb 2024 15:05:42 GMT

Thanks!! It works

Re: XQL to get details of endpoints installed in last 12 hrs

aspatil — Fri, 23 Feb 2024 15:15:39 GMT

Hello Shahwaz,

Apart from this you can create a report by going to Dashboard & Repors --> Report templates--> New Template.

Look for Number of installed agents in the Widgets Library and configured the same as per your requirements.