Cortex XDR Checkin Time

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.
Palo Alto Networks Approved
Palo Alto Networks Approved
Community Expert Verified
Community Expert Verified

Cortex XDR Checkin Time

L0 Member

Hello All,


Was curious, is there a related registry key for Traps last check-in date? I'm curious if there is an easy way to pull in that information with powershell.


Quick example scenario would be that we would use one script to pull in the last check in time with multiple computers with Cortex XDR.




L5 Sessionator

There are a few ways to achieve this in decreasing order of preference to collect the data:

  1. Get the last seen timestamp from XDR API's (Ref:
  2. Run "cytool last_checkin" on the endpoint (Ref:




Thank you for the quick reply. That helps a lot. Would it be possible without access to the management console?

Hi @Amnsgna 


The second option suggested by @bbarmanroy - "run cytool last_checkin" is the option "without access to the management console".

Cytool is CLI tool that is installed with CortexXDR agent on each endpoint and can be used to troubleshoot and manage the XDR agent.


With this option you need to execute  the command on each individual endpoint and check the output.


  • 3 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!