Detect delete agent with XQL.

mirtoghrulseyid — Thu, 17 Oct 2024 07:24:43 GMT

I kindly ask for your assistance with an XDR XQL query language script to identify devices in the network that do not have the XDR agent installed. Additionally, it would be helpful if the users could be identified from AD or through the DHCP on the network."

Re: Detect delete agent with XQL.

mavega — Thu, 17 Oct 2024 20:50:14 GMT

Hi,

Thanks for reaching out.

You can sort unmanaged devices on your network by configuring your networks parameters in Cortex, it will scan your environment and will let you know which assets are unmanaged.

This link can help you set up your networks parameters:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Configure-Your-Network-Parameters

Alternatively, you can run this below script (this is just an example and you might need to modify it to adjust your needs):

config case_sensitive = false
| dataset = pan_dss_raw

| alter name = rtrim(name, "$")
| filter lowercase(name) not in (dataset = endpoints | fields endpoint_name as jds_endpoint_name | alter jds_endpoint_name = lowercase(jds_endpoint_name))

| filter OS in("*Windows*", "*Linux*", "*Mac*")

| fields Name, OS, Os_Ver, last_modified_dc_record, domain_name, DN

| alter time_range = timestamp_diff(current_time(), last_modified_dc_record, "DAY")
| filter time_range < 60
| sort desc last_modified_dc_record

| dedup Name

If this solutions solves your issue please mark it as solved.

Regards.

Re: Detect delete agent with XQL.

mirtoghrulseyid — Fri, 18 Oct 2024 08:17:48 GMT

thanks for helping

topic Re: Detect delete agent with XQL. in Cortex XDR Discussions

Detect delete agent with XQL.

Re: Detect delete agent with XQL.

Re: Detect delete agent with XQL.