Request for Query to Retrieve Endpoint Security Details.

Prashanta — Mon, 02 Feb 2026 06:00:42 GMT

Hi Team,

I would like to create a query that provides the following information for endpoint security events:

Severity
Artifact type (e.g., executable files or other relevant artifacts)
Endpoint name
IP address
Windows OS version
Action taken (e.g., Block or Alert)
Cortex Agent version

Timeframe: I will be set manually

Please let me know the best way to construct this query or if any additional details are required.

Re: Request for Query to Retrieve Endpoint Security Details.

susekar — Mon, 02 Feb 2026 13:40:00 GMT

Hello @Prashanta ,

Greetings for the day.

To create a query that retrieves security events along with endpoint metadata, you can use the alerts dataset as the primary source. Since details such as the full Windows OS version and Cortex Agent version are most accurately maintained in the endpoints dataset, a left join is recommended to combine these two datasets.

XQL Query

dataset = alerts
| join type = left (dataset = endpoints) as e e.endpoint_name = host_name
| fields
    severity,
    category as artifact_type,
    host_name as endpoint_name,
    host_ip as ip_address,
    e.os_version as windows_os_version,
    action as action_taken,
    e.agent_version as cortex_agent_version

Field Explanations

Severity: Retrieved directly from the alerts dataset.
Artifact Type: The category field identifies the type of security issue, such as Malware, Exploit, or Behavioral Threat.
Action Taken: Displays the outcome of the event, for example ENUM.PREVENTED__BLOCKED_ or Alert.
Windows OS Version & Agent Version: Retrieved from the endpoints dataset through the join to ensure the most up-to-date inventory information for the endpoint.

How to Use

Navigate to Investigation > Query Builder.
Switch to the XQL tab.
Paste the query into the editor.
Set the desired Time Range using the manual selector.
Click Run.

Note: If you need to view the specific executable file associated with an alert, you can add action_file_name to the fields list in the query.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar

Re: Request for Query to Retrieve Endpoint Security Details.

Prashanta — Sat, 07 Feb 2026 03:37:29 GMT

Thank You for reply.

Showing
e.os, e.agent is not a valid value.

topic Re: Request for Query to Retrieve Endpoint Security Details. in Cortex XDR Discussions

Request for Query to Retrieve Endpoint Security Details.

Re: Request for Query to Retrieve Endpoint Security Details.

XQL Query

Field Explanations

How to Use

Re: Request for Query to Retrieve Endpoint Security Details.