cortex xdr custom xql query to view server operational status

[vinohtkumar]

hi,

Most of the customer who uses paloalto cortex xdr want to visualize the server operational status in a dashboard in that case use below query as follows,

"dataset = endpoints | filter operating_system contains "windows server" or operating_system contains "ubuntu" | fields endpoint_name as endpoint_name, operating_system as operating_system, operational_status as operational_status, last_successful_scan as last_successful_scan, domain as domain, agent_version as agent_version"

Steps:

1. Login to cortex console

2. Navigate incident response tab-> query builder -> click xql search

3. Input the query and run

4. Click Save as widget and use it with dashboard.

[aspatil]

Hello @vinohtkumar ,

Do you need any assistance with this, or is it just a post?

Regards,

Ashutosh

[vinohtkumar]

@aspatil just knowledge sharing.