cortex xdr custom xql query to view server operational status

vinohtkumar — Fri, 04 Apr 2025 06:44:21 GMT

hi,

Most of the customer who uses paloalto cortex xdr want to visualize the server operational status in a dashboard in that case use below query as follows,

"dataset = endpoints | filter operating_system contains "windows server" or operating_system contains "ubuntu" | fields endpoint_name as endpoint_name, operating_system as operating_system, operational_status as operational_status, last_successful_scan as last_successful_scan, domain as domain, agent_version as agent_version"

Steps:

1. Login to cortex console

2. Navigate incident response tab-> query builder -> click xql search

3. Input the query and run

4. Click Save as widget and use it with dashboard.

Re: cortex xdr custom xql query to view server operational status

aspatil — Wed, 09 Apr 2025 13:22:59 GMT

Hello @vinohtkumar ,

Do you need any assistance with this, or is it just a post?

Regards,

Ashutosh

Re: cortex xdr custom xql query to view server operational status

vinohtkumar — Fri, 11 Apr 2025 05:24:27 GMT

@aspatil just knowledge sharing.

topic cortex xdr custom xql query to view server operational status in Cortex XDR Discussions

cortex xdr custom xql query to view server operational status

Re: cortex xdr custom xql query to view server operational status

Re: cortex xdr custom xql query to view server operational status