topic Re: XQL query search for "Connection Lost" computers in Cortex XDR Discussions

XQL query search for "Connection Lost" computers

Piotr_Kowalczyk — Fri, 19 Apr 2024 16:02:15 GMT

Hi,

I'm trying to find a query which will show me computers with status "Connection Lost".

Sadly I'm not able to do this in both preset = host_inventory (can't find the computer which has this status in the Cortex Dashboard) as well as dataset = endpoints where I'm able to find the computer but there is no status in any column.

Could somebody advise please?

Re: XQL query search for "Connection Lost" computers

jmazzeo — Fri, 19 Apr 2024 18:17:44 GMT

Hi @Piotr_Kowalczyk , thanks for reaching us using the Live Community.

Please try this XQL Query, add the fields as you need, and any other extra information thay you may require:

dataset = endpoints | filter endpoint_status = ENUM.CONNECTION_LOST | fields endpoint_name, ip_address, operating_system, agent_version, last_seen

If this post answers your question, please mark it as the solution.

Re: XQL query search for "Connection Lost" computers

Piotr_Kowalczyk — Mon, 22 Apr 2024 08:25:40 GMT

It works - thank you!