topic Re: Report XQL Bitlocker in Cortex XDR Discussions

Report XQL Bitlocker

hanslapire — Wed, 22 May 2024 09:32:35 GMT

Hello,

I created a report to display computers with Bitlocker that is not compliant :

config case_sensitive = false | dataset = endpoints | filter encryption_status = ENUM.APPLYING or encryption_status = ENUM.NOT_COMPLIANT | filter endpoint_type = ENUM.TYPE_WORKSTATION | fields endpoint_name

When I test with real data, for example, it report 14 endpoints, but into the PDF report, it only show the first 3 endpoints, even it display that it found 14 results, it only print the 3 first endpoint name.

Any idea why ?

Thanks

Best regards

Re: Report XQL Bitlocker

jmazzeo — Wed, 22 May 2024 15:06:46 GMT

Hi @hanslapire, thanks for reaching us using the Live Community.

Are you using the same timeframe in the report and in the XQL Query? Maybe the report takes a shorter time than the query and that's why the result is different.

If this post answers your question, please mark it as the solution.

Re: Report XQL Bitlocker

rufat87 — Mon, 27 May 2024 18:24:34 GMT

PDF reports are generally terrible in cortex XDR, rendering is just awful with missing data. I suggest to make a custom widget with your query and then use it to produce and deliver CSV when you create and schedule report template. CSV seems to be much more reliable.