topic [Multi-Tenancy] Cortex XDR Connected Endpoints tenant by tenant in Cortex XSOAR Discussions

[Multi-Tenancy] Cortex XDR Connected Endpoints tenant by tenant

EnesOzdemir — Fri, 07 Apr 2023 13:14:00 GMT

Hi everyone,

In a dashboard, I want to display the total number of connected endpoints tenant by tenant with a pie chart if possible. There is a script named "XDRConnectedEndpoints" however it can only display the total number in all tenants. How should I approach to this?

Re: [Multi-Tenancy] Cortex XDR Connected Endpoints tenant by tenant

amore — Tue, 11 Apr 2023 19:24:52 GMT

Hi @EnesOzdemir The script is a great start. I suggest you duplicate the script and edit the lines 23 and 24. If you look closely, line 23 specifically asks to 'get' the count. Line 24 returns that as a result. If you identify how to get the actual tenant names in line 23, you can achieve your desired result. Please let us know how it goes. Good luck!

Re: [Multi-Tenancy] Cortex XDR Connected Endpoints tenant by tenant

EnesOzdemir — Wed, 12 Apr 2023 10:13:32 GMT

Hi, I managed to do what I want with

pie = BarColumnPieWidget()
tenant_name = get_tenant_account_name()
pie.add_category(tenant_name, count)
return_results(pie)

This code will be executed on all the tenants and the results will return to the main server. The result looks something like

[{name: fieldname, 'value': count}] so not that confusing at all.

I hope there is also a way to execute scripts on a single tenant because I now just want to display a simple markdown table in a dashboard. I know that it is achievable with a simple markdown text widget however configuring a list much easier than configuring a widget. Lists can be used across xsoar war rooms dynamic sections and everything whereas widget contents cannot be used anywhere else.