Clients/Server do not have assigned endpoint group ALERT / CORRELATION / XQL

[RFeyertag]

Hello dear community, 

I want to share with you my little XQL script which can identify and alert connected Clients which have no assigned endpoint group. 

This can happen:

- Cortex is installed, but the endpoint name does not match the defined criteria

- Endpoint name is changed, does not match the defined criteria

dataset = endpoints
| filter group_names != "*"
| filter endpoint_status ~= "CONNECTED" and endpoint_status !~= "DISCONNECTED"

BR

Rob

[bbarmanroy · Accepted solution]

Good work there, @RFeyertag !
A few observations:
I'd recommend changing the operator in 3rd line to not do regex as the values can always be an exact match (CONNECTED/DISCONNECTED).

So something like this :

| filter endpoint_status= ENUM.CONNECTED or endpoint_status = ENUM.DISCONNECTED 

or 

| filter endpoint_status in (ENUM.CONNECTED , ENUM.DISCONNECTED )

will do too.

[RFeyertag]

Thank you @bbarmanroy,

with your recommendation it works much better!

BR

Rob