Cortex Installed

[cylusaragao]

expensive,

Would you have an xql where it brings from the machines in my park which ones have the cortex installed or not?

[nsinghvirk]

Hello @cylusaragao 

Thanks for reaching out on LiveCommunity!

The "endpoints" dataset is the one which list all the endpoints that have XDR agent installed on them.

To find out the endpoints which do not have XDR agent, you need to compare the endpoint list in "endpoints" dataset with datasets with your active directory data, Network mapper etc. 

Example

dataset = PANW_Network_Mapper_raw 
| filter lowercase(name) not in (dataset=endpoints| filter endpoint_status in (ENUM.CONNECTED , ENUM.DISCONNECTED )| alter hostn = lowercase(endpoint_name )| fields hostn)

Alternatively , you can simply go to Assets->Asset inventory->All asset

Then apply filter on column "Has XDR agent".

Please click Accept as Solution to acknowledge that the answer to your question has been provided.