topic Re: Devices that are down cortex XDR in Cortex XDR Discussions

Devices that are down cortex XDR

Shmuel — Thu, 29 Jul 2021 13:48:10 GMT

Hi,

I have devices that are down, how can I find them? In the interface, I only see the devices in status connected or disconnected

Thanks.

Re: Devices that are down cortex XDR

jcandelaria — Thu, 29 Jul 2021 15:29:22 GMT

Hi Shmuel,

Not sure what you mean by down?

We will show the xdr agent status as below.

Connected
—The Cortex XDR agent has checked in within 10 minutes for standard endpoints, and within 3 hours for mobile endpoints.
Connection Lost
—The Cortex XDR agent has not checked in within 30 to 180 days for standard endpoints, and between 90 minutes and 6 hours for VDI and temporary sessions.
Disconnected
—The Cortex XDR agent has checked in within the defined inactivity window: between 10 minutes and 30 days for standard and mobile endpoints, and between 10 minutes and 90 minutes for VDI and temporary sessions.

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-prevent-admin/investigation-and-response/investigate-endpoints/view-details-for-an-endpoint

You can also create a filter from endpoint administration using Last Seen. ex. screenshot below with endpoint status disconnected and last seen 7 Days

Re: Devices that are down cortex XDR

Shmuel — Thu, 29 Jul 2021 16:08:12 GMT

Hi Jcandelaria

I'll explain. I have a user's computer that has Traps in place but is disabled. I am looking for a computer name in an administrative interface I do not see the computer. That's why I want to scan my network and find stations that don't communicate with the server

I'm uploading, you a screenshot.

Thank you.

Re: Devices that are down cortex XDR

jcandelaria — Thu, 29 Jul 2021 16:57:42 GMT

This is a little bit tricky, since the agent is disconnected for a long time probably more than 180 or either some issue with agent itself that cause it to be disconnected to the tenant. Once its past 180 days, the endpoint is gone on from the table.

I believe your issue might be that most of these endpoints have older-older 🙂 version possibly 7.1

A possible workaround is looking at agent audit logs then filter Sub-Type = Stop, then from there you can filter XDR Agent Version Contains contains 7.1 . That will give you the list of the agents to start with. Then you can compare the list with connected.

Other option is to use a tool like sccm to check the protection status of the agent. You can submit a support case on this and ask for the registry that you can use.

Re: Devices that are down cortex XDR

Shmuel — Thu, 29 Jul 2021 18:24:50 GMT

Thank you

Re: Devices that are down cortex XDR

Shmuel — Sun, 01 Aug 2021 17:14:10 GMT

Hello everyone

I'm updating that after a conversation with support at the moment there is no way to find devices that are not on a management panel and are in the status disabled.

Thank you