The detailed 4-digit Windows patch level (known as the Update Build Revision (UBR)) is not natively available as a standard, indexed field within the Cortex XDR/XSIAM management console or within standard Cortex Data Lake datasets (such as endpoints or host_inventory).

By design, the platform synchronizes only the major OS build number (for example, 10.0.22631). The granular revision string changes frequently and is not considered critical for standard security monitoring.

How to Retrieve the Full Patch Level:

1. On-Demand Collection via Action Center (Recommended for Bulk):

You can use the Action Center to run a remote command that gathers the full Windows version string from selected endpoints.

Steps:

Navigate to:
Incident and Response > Response > Action Center
Click + New Action and select Run Endpoint Scripts.
Search for and select the execute_commands script.
In the Script Parameter field, enter the native Windows command: ver

Select your target hosts and click Run.
After execution completes, the full version string (for example:
Microsoft Windows [Version 10.0.22631.4317]) will appear in the Action Center results column.

2. Live Terminal (Single Endpoint):

For an individual endpoint, you can use Live Terminal and run the following PowerShell command:

Get-ComputerInfo -Property WindowsProductName, WindowsVersion, OsHardwareAbstractionLayer

This returns detailed OS version properties directly from the system.

3. Agent Log Analysis (Troubleshooting Method):

The revision number is also captured locally by the agent. It can be found in the cortex-xdr-payload.log file under the UBR (Update Build Revision) key.

Typical file location:

C:\ProgramData\Cyvera\Logs\SandboxService\ClassificationEngine\cortex-xdr-payload.log
 

Note: Accessing this file requires either manual retrieval from the endpoint or generating a Tech Support File (TSF). This method is generally used for troubleshooting rather than large-scale reporting.

Summary:

The 4-digit Windows UBR is not indexed in XDR/XSIAM datasets.
Only the major build number is synchronized by default.
To obtain the full patch level, use:
- Action Center (recommended for multiple endpoints)
- Live Terminal (single endpoint)
- Agent log review (advanced troubleshooting)

topic Cortex Data Lake - Windows 11 Build & Enablement(?) Info in Cortex XDR Discussions

Cortex Data Lake - Windows 11 Build & Enablement(?) Info

Re: Cortex Data Lake - Windows 11 Build & Enablement(?) Info

How to Retrieve the Full Patch Level:

1. On-Demand Collection via Action Center (Recommended for Bulk):

Steps:

2. Live Terminal (Single Endpoint):

3. Agent Log Analysis (Troubleshooting Method):