topic How to count endpoint ACTUAL ACTIVITY by SQL query in Cortex XDR Discussions

How to count endpoint ACTUAL ACTIVITY by SQL query

SAlasker — Tue, 23 Jul 2024 07:39:40 GMT

Dears,

"ACTUAL ACTIVITY" graph under user card page in XDR is very amazing feature show the duration of user working hours.

Unfortunately, the time was not specified with exact minuets. My management asks me a very accurate duration of how many hours the user was actively working last month to calculate his overtime.

Would you help me with SQL query will calculate the actual active working hours.

Re: How to count endpoint ACTUAL ACTIVITY by SQL query

aspatil — Tue, 23 Jul 2024 11:06:56 GMT

Hello @SAlasker ,

Thanks for reaching out on LiveCommunity!

You cannot fetch the required information using XQL. This is ITDR feature .

Hope this helps!

Regards,

Ashutosh