topic XQL query checking BitLocker status in Cortex XDR Discussions

XQL query checking BitLocker status

Piotr_Kowalczyk — Mon, 22 Apr 2024 15:05:25 GMT

Hi,

I can see BitLocker status in Dashboard -> Endpoint -> Disk Encryption Visibility, but when I try to do the same with XQL query, I wasn't able to find Columns Status in any of preset or dataset. Can somebody help me with this please? I would like to add BitLocker status to my report.

Re: XQL query checking BitLocker status

jmazzeo — Mon, 22 Apr 2024 15:57:34 GMT

Hi @Piotr_Kowalczyk, thanks for reaching us using the Live Community.

You can get a quick view on the encryption status using the XQL Query:

dataset = endpoints | fields encryption_status, endpoint_name

Add any required filter and/or fields to that query to match your requirements.

If this post answers your question, please mark it as the solution.

Re: XQL query checking BitLocker status

Piotr_Kowalczyk — Mon, 22 Apr 2024 16:10:13 GMT

Hi Jmazzeo,

Thank you for your reply.

Sadly this solution doesn't work for me as we don't manage encryption with Cortex so the result of this query is NOT_CONFIGURED for all endpoints. I can see what I'm looking for in the column "VOLUMES STATUS" but I can't find this data using XQL query.

Re: XQL query checking BitLocker status

jmazzeo — Mon, 22 Apr 2024 17:16:27 GMT

In that case, if you don't use the XDR Drive Encryption management you can't access to the status using XQL. That information is only available on the UI, it is not published to a dataset at the moment.

Re: XQL query checking BitLocker status

Piotr_Kowalczyk — Tue, 23 Apr 2024 09:06:04 GMT

thank you