Cortex XDR report

[RomainCouvreur]

Hello Live community,

I have a question about the report on Cortex, i want to know if the “Infected Endpoints” comes as default in Cortex reports or if we need to configure something to show that option?

Do the widgets "incidents by source" or "Top incidents (Top 10) " display the infected Host?

I suppose that incidents by source will be the closest thing to infected host.

As i can understand, if the agent has created an event, it s because Cortex has done its job and prevent the host from being infected, so the host is not infected. But will we see it in the Report? Or how can we see it in the report?

Thanks in advance for your reply.

Best regards.

[dfalcon]

Hi @RomainCouvreur-

I'm not sure I understand the ask.  Are you looking for a report that shows you malware events (to include the host) that need your attention?  Or do you want to see all hosts that had malware events that also may have had preventions?

[RomainCouvreur]

Hello David,

Thank you for your prompt reply.

We are looking for a report that shows us malware events (to include the host) that need our attention.

Best regards.

[dfalcon · Accepted solution]

Hi @RomainCouvreur-

The XQL xdr_data dataaset does not include alert data.  Until that dataset is exposed, the easiest way to look for the rare cases that need your attention is to filter for XDR agent and post detections in the alert table as shown below.