Require help in XQL Query

S.Patil392541 — Fri, 10 Jan 2025 07:20:39 GMT

Need help to create a xql query to detect the COnnection lost devices along with the reasons for connection lost.

Re: Require help in XQL Query

neelrohit — Wed, 15 Jan 2025 16:32:47 GMT

Thank you for writing to live community!

The reasons for connection lost can be many but a broadline logic is a continuous disconnection to the cloud for a default of more than 30days. The reasons are not exposed to the server and as a result, it is not possible to create XQL for these endpoints with reasons. These endpoints need a manual intervention to check for services and connectivity and/or other agent related reasons for validation.

Hope this helps.Please mark the response as "Accept as Solution" if it answers your query.

topic Require help in XQL Query in Cortex XDR Discussions

Require help in XQL Query

Re: Require help in XQL Query