https://live.paloaltonetworks.com/t5/endpoint-traps-discussions/automatically-scan-newly-onboarded-devices/m-p/592478#M1158 <P>I would like to trigger a full endpoint scan when an endpoint is first onboarded (machine is imaged, agent is freshly installed). I think there must be a way using a Correlation rule or BIOC rule to trigger an alert which causes an action to scan the endpoint. Does anyone out there has a good XQL query or BIOC rule that would define this?</P> Thu, 18 Jul 2024 19:09:02 GMT Jeremy_Phipps 2024-07-18T19:09:02Z https://live.paloaltonetworks.com/t5/endpoint-traps-discussions/automatically-scan-newly-onboarded-devices/m-p/592478#M1158 <P>I would like to trigger a full endpoint scan when an endpoint is first onboarded (machine is imaged, agent is freshly installed). I think there must be a way using a Correlation rule or BIOC rule to trigger an alert which causes an action to scan the endpoint. Does anyone out there has a good XQL query or BIOC rule that would define this?</P> Thu, 18 Jul 2024 19:09:02 GMT https://live.paloaltonetworks.com/t5/endpoint-traps-discussions/automatically-scan-newly-onboarded-devices/m-p/592478#M1158 Jeremy_Phipps 2024-07-18T19:09:02Z