Cortex Assets Report without agent installed

[QuestionAb]

Hi everyone,

I'm working on a security visibility project and would like to leverage the Asset Inventory module to generate a detailed report of all Windows machines that do not yet have the Cortex XDR agent installed.

The main goal is to use that data as the source for a dashboard widget.

I'm new to XQL and have been trying to build a query with dataset. If anyone has worked with this before or has experience with this type of query, I would really appreciate your guidance.

Thank you very much in advance for any help or suggestions.

[susekar · Accepted solution]

Hello @QuestionAb ,

Greetings for the day.

In Cortex XDR, the Asset Inventory data is not currently exposed as a native queryable XQL dataset. This is a known platform limitation, and a feature request (ID: CXDR-I-1481) exists to include this functionality in future updates.

However, you can achieve your goal by performing a comparison between your "source of truth" for Windows machines (Active Directory data via the Directory Sync Service) and the list of active agents in the endpoints dataset.

 

Prerequisites:

To use this XQL query, you must have:

• The Cloud Identity Engine (CIE) configured to sync your Active Directory / Directory Sync Service (DSS) data.

• The pan_dss_raw dataset successfully populating in your environment.

 

XQL Query for Unmanaged Windows Machines

The following query identifies computer objects present in your directory but missing from the Cortex XDR managed endpoints list, filtered specifically for Windows systems.

dataset = pan_dss_raw
| filter type = "computer" and os contains "Windows"
| fields name, os, ou
| dedup name
| alter dss_hostname = lowercase(name)
| filter dss_hostname not in (
dataset = endpoints
| alter endpoint_hostname = lowercase(endpoint_name)
| fields endpoint_hostname
)

Building the Dashboard Widget

To use this data for a dashboard widget:

1. Navigate to Dashboard & Reports → Widget Library.

2. Select Create Widget and choose XQL Search as the source.

3. Paste the query above.

4. Configure the visualization:

   • Use a Table for a detailed report.

   • Use a Stat widget to count missing agents with:

| stats count(dss_hostname)

Alternative: Manual Identification

If you do not have CIE/DSS configured, you can manually identify unmanaged assets through the console UI:

1. Navigate to Assets → Asset Inventory.

2. Locate the column HAS XDR AGENT (or AGENT INSTALLED) and filter for No.

3. Add a filter for Operating System containing Windows.

4. Export the results to a TSV or CSV file for reporting.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar