Cortex Installed

cylusaragao — Mon, 06 Jan 2025 12:36:13 GMT

expensive,

Would you have an xql where it brings from the machines in my park which ones have the cortex installed or not?

Re: Cortex Installed

nsinghvirk — Wed, 15 Jan 2025 16:29:54 GMT

Thanks for reaching out on LiveCommunity!

The "endpoints" dataset is the one which list all the endpoints that have XDR agent installed on them.

To find out the endpoints which do not have XDR agent, you need to compare the endpoint list in "endpoints" dataset with datasets with your active directory data, Network mapper etc.

Example

dataset = PANW_Network_Mapper_raw
| filter lowercase(name) not in (dataset=endpoints| filter endpoint_status in (ENUM.CONNECTED , ENUM.DISCONNECTED )| alter hostn = lowercase(endpoint_name )| fields hostn)

Alternatively , you can simply go to Assets->Asset inventory->All asset

Then apply filter on column "Has XDR agent".

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

topic Re: Cortex Installed in Cortex XDR Discussions

Cortex Installed

Re: Cortex Installed