XDR Collector Status on Dashboard

MichaelStaMaria — Thu, 29 Oct 2026 01:04:32 GMT

Hi Everyone,

I'm having trouble finding a way to create a widget displaying the XDR Collector status and create a custom correlation rule for a disconnected XDR Collector.

I'm not able to find the correct dataset to use in the query.

I used Agentic Assistant and was not able to generate the query correctly

Is this feasible on Cortex XDR Pro?

Re: XDR Collector Status on Dashboard

susekar — Mon, 02 Nov 2026 14:06:09 GMT

Hello @MichaelStaMaria ,

Greetings for the day.

Yes, this is feasible in Cortex XDR Pro.

Cortex XDR Pro supports monitoring collector health, connectivity, and error events using the collection_auditing dataset.

1. Dataset for Collector Monitoring

Use the collection_auditing dataset to track collector status changes and operational events.

Key fields include:

collector_type – Identifies the collector type.
classification – Event severity/category (Error, Warning, Information).
description – Details of the status change or error.
_time – Timestamp of the event.

2. Dashboard Widget

Create a custom XQL widget from the Widget Library.

To display collector status events:

sql

dataset = collection_auditing
| filter collector_type != null
| sort desc _time

To display error events only:

sql

dataset = collection_auditing
| filter classification = "Error"
| sort desc _time

3. Correlation Rule for Collector Errors

A custom Correlation Rule can be configured to generate alerts when collector errors or disconnection events occur.

Example XQL:

sql

dataset = collection_auditing
| filter classification = "Error"

Recommended configuration:

Schedule: Hourly
Query timeframe: 1 hour
Alert suppression: Enabled
Action: Generate Alert
Category: Collection

For email or ticketing notifications, configure Notification Forwarding under Settings → Configuration → Integrations → Notification Forwarding.

4. Agentic Assistant

If Agentic Assistant (TextToXQL) does not generate the expected query, manually writing and executing the XQL query against collection_auditing is the recommended alternative.

Conclusion: Collector health monitoring and error alerting can be implemented in Cortex XDR Pro using the collection_auditing dataset, custom dashboard widgets, and Correlation Rules.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar

Re: XDR Collector Status on Dashboard

MichaelStaMaria — Tue, 03 Nov 2026 01:26:57 GMT

Hello @susekar,

After running the xsql query for collection_auditing, the output showed only the Broker VM and O365.

Is it possible that there is a hidden dataset for XDR Collector Status that is only accessible by PAN backend?

topic XDR Collector Status on Dashboard in Cortex XDR Discussions

XDR Collector Status on Dashboard

Re: XDR Collector Status on Dashboard

1. Dataset for Collector Monitoring

2. Dashboard Widget

3. Correlation Rule for Collector Errors

4. Agentic Assistant

Re: XDR Collector Status on Dashboard