Cortex XDR Checkin Time

[Amnsgna]

Hello All,

Was curious, is there a related registry key for Traps last check-in date? I'm curious if there is an easy way to pull in that information with powershell.

Quick example scenario would be that we would use one script to pull in the last check in time with multiple computers with Cortex XDR.

Thanks!

[bbarmanroy]

There are a few ways to achieve this in decreasing order of preference to collect the data:

1. Get the last seen timestamp from XDR API's (Ref: https://cortex-panw.stoplight.io/docs/cortex-xdr/fde2236a93dfe-get-all-endpoints)
2. Run "cytool last_checkin" on the endpoint (Ref: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.9/Cortex-XDR-Agent-Administrator-Guide/Cytoo...)

[Amnsgna]

Hello,

Thank you for the quick reply. That helps a lot. Would it be possible without access to the management console?

[aleksandar.astardzhiev]

Hi @Amnsgna 

The second option suggested by @bbarmanroy - "run cytool last_checkin" is the option "without access to the management console".

Cytool is CLI tool that is installed with CortexXDR agent on each endpoint and can be used to troubleshoot and manage the XDR agent. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/8.0/Cortex-XDR-Agent-Administrator-Guide/Cytoo...

With this option you need to execute  the command on each individual endpoint and check the output.