topic GlobalProtect App Log Collection - Determining Disconnected Agents in Cortex XDR Discussions

GlobalProtect App Log Collection - Determining Disconnected Agents

nohash4u — Wed, 25 Jun 2025 17:32:47 GMT

Is there a way to automate the sending of GlobalProtect app logs to SLS?

Based on the following I have only found ways to enable the end user to manually send logs to SLS:

The ultimate goal is to find a consistent method to determine which specific endpoints have GlobalProtect agents that are not connected.

Would a tool like Cortex XDR be better equipped for this?

Cheers,

Nohash4u

Re: GlobalProtect App Log Collection - Determining Disconnected Agents

jmazzeo — Mon, 30 Jun 2025 12:37:51 GMT

Hi @nohash4u,

With Cortex XDR and the Host Insight add-on you can have the list of applications installed on every endpoint, and also get the list of services running on them. With that, you can run a custom query to get all the data joined and use it as a good reference for what you are looking for.

If this posts answers your question, please mark it as the solution.

Re: GlobalProtect App Log Collection - Determining Disconnected Agents

nohash4u — Mon, 30 Jun 2025 15:06:54 GMT

Thanks @jmazzeo for the response. I am finding Cortex XDR is better equipped for this solution. I will keep you posted with my final solution.

Cheers

Re: GlobalProtect App Log Collection - Determining Disconnected Agents

nohash4u — Thu, 03 Jul 2025 15:19:15 GMT

Update

I have found the best option is to use Cortex XDR to search all endpoints (Endpoints --> All Endpoints) with the following filter:

Endpoint Status = Connected and IP Address != enter_GlobalProtect_subnet_range_here

Naturally, this is contingent on the endpoint having XDR installed and connected to determine the endpoint is functional, but not connected to GlobalProtect. Also, this is based on the understanding that the IP address pool determined by the GlobalProtect portal agent config will appear in the endpoint's ipconfig when it is actively connected to the GlobalProtect gateway.

Thanks again @jmazzeo!