topic Help - XQL Query for Unprotected assets in Cortex XDR Discussions

Help - XQL Query for Unprotected assets

BOtero1 — Tue, 29 Jul 2025 15:02:36 GMT

Hi, everyone.

I have a use case of creating a Correlation rule to track the asset where the operational status of the agent changed from "Protected" to "Unprotected". I am having a hard time building the actual query. Any ideas?

Im currently only tracking asset under "Unprotected" but that generates a lot of noise as any new deployment the initial status of the agent will be "Unprotected" therefore the alert will trigger. So this is not accurate at all.

Current query:

dataset = endpoints | filter endpoint_status = ENUM.CONNECTED and operational_status = "UNPROTECTED"
| dedup endpoint_id
| fields endpoint_id , endpoint_name , endpoint_type, endpoint_status, operational_status, operational_status_description, operating_system, ip_address, tags

Re: Help - XQL Query for Unprotected assets

micomi — Wed, 30 Jul 2025 06:28:17 GMT

You could probably just filter out newly installed agents.

| alter install_date_difference = timestamp_diff(current_time(), install_date, "DAY") // calculate the amount of days since the XDR agent was installed.
| filter install_date_difference > 1 // Set/filter the amount of days when the correlation rule should trigger. In this example the agent needs to be installed for 2 days and more

timestamp_diff would also support the difference in hours.

Hope this helps

Re: Help - XQL Query for Unprotected assets

BOtero1 — Wed, 30 Jul 2025 18:09:23 GMT

Amazing! Thanks! That works like a charm.