topic Re: Cortex XDR XQL Query in Cortex XDR Discussions

Cortex XDR XQL Query

C.Djoulah — Wed, 28 Aug 2024 14:16:11 GMT

Hi,
I wanna sort my query as operational_status in (UNPROTECTED, PARTIALLY_PROTECTED) everyday (Like from Monday to Sunday Statistics)
My query looks like this
config case_sensitive = false
| dataset = endpoints
| filter operational_status in (UNPROTECTED, PARTIALLY_PROTECTED)
| comp count(endpoint_name) as Number_of_endpoints

Re: Cortex XDR XQL Query

jmazzeo — Thu, 29 Aug 2024 17:42:43 GMT

Hi @C.Djoulah, thanks for reachin us using the Live Community.

If I understand your question, you need some sort of timeline with how many endpoints are in UNPROTECTED or PARTIALLY_PROTECTED status each day of the week, am I right?

Thanks