Cortex XDR XQL query to get list of all vulnerabilities

tejaspatil12 — Thu, 27 Mar 2025 09:34:37 GMT

Hello All,

Could someone assist me with a Cortex XDR XQL query to list all vulnerabilities along with their associated endpoints? I'm looking for a list that includes each endpoint and its unique CVEs.

also Does Cortex XDR gives remediation details along with vulnerability ?

#Hostinsight

Re: Cortex XDR XQL query to get list of all vulnerabilities

tlmarques — Thu, 27 Mar 2025 10:02:53 GMT

Hi @tejaspatil12 ,

Using XQL, you can view CVEs for all or specific endpoints:

dataset = va_cves
| fields name, cve_id , severity , severity_score, affected_hosts
|arrayexpand affected_hosts
| join(preset = host_inventory_endpoints | fields endpoint_name, operating_system , endpoint_type, last_report_time )
as ep ep.endpoint_name = affected_hosts
| filter (`affected_hosts` = """XTP""")

I believe XDR does not provide remediation or solution details.

On the Vulnerability page, for each CVE, you can find the NIST link, which will take you to the NIST page for more details.

topic Re: Cortex XDR XQL query to get list of all vulnerabilities in Cortex XDR Discussions

Cortex XDR XQL query to get list of all vulnerabilities

Re: Cortex XDR XQL query to get list of all vulnerabilities