topic Email alert when a device checks in? in Cortex XDR Discussions

Email alert when a device checks in?

evansbc1 — Wed, 19 Mar 2025 20:13:17 GMT

Hello,

Can XDR send an email when a specific device checks in?

Thanks!

Re: Email alert when a device checks in?

aspatil — Thu, 20 Mar 2025 05:05:32 GMT

Hello @evansbc1 ,

What is mean by device checks in ? Do you mean USB is plugged?

Re: Email alert when a device checks in?

evansbc1 — Thu, 20 Mar 2025 12:21:58 GMT

Hello Aspatil,

I mean can XDR send an email alert when a specific PC checks in with the XDR servers?

Thanks for your help.

Re: Email alert when a device checks in?

aspatil — Thu, 20 Mar 2025 12:47:12 GMT

Why do you want to do that? This will be very noisy. The Cortex XDR Agent performs a heartbeat or check in approximately every 5 minutes.

Re: Email alert when a device checks in?

evansbc1 — Thu, 20 Mar 2025 13:15:32 GMT

Thanks for the heads up. We only need to do this for one laptop. We need to know when it comes online so we can find it.

Re: Email alert when a device checks in?

jmazzeo — Thu, 20 Mar 2025 13:28:54 GMT

Hi @evansbc1, you could try a correlation rule using this XQL:

dataset = endpoints | filter endpoint_status = ENUM.CONNECTED and endpoint_name = "YourHostname"

Schedule the rule to run every 10 minutes and you will have an alert when it's online. Then you can create an Automation Rule when this alert is generated, and send a notification email or slack message if you have it.

If this post answers your question, please mark it as the solution.