Create notification/alerts for failed upgrade and outdated endpoint

[dahang]

Hello,

I would like to be notify when an endpoint is outdated or when an upgrade failed.

I'm aware there is the notifications pages,

LIVEcommunity - Notification if Cortex XDR agent fails to upgrade - LIVEcommunity - 531271 (paloalto...

But there is not the filter that I want.  I want this only on a specific endpoint group name / tags.

My other fear is the fact that we will be spam if an endpoint try again and again to be upgrade and failed.

We can set it per day, but that can lead to an unreadable email.

I try to do it with the report schedule.

That is more complete, I can filter to the scope that I want, receive it per month.

Unfortunately, there is no widget to show what endpoint are outdated, have to create it from XQL widget.

but I'm only starting, I have some difficulties with XQL.

Does someone have a solution ?

Best regards

[dbahuguna]

Hi @dahang ,

Thank you for reaching out to Palo Alto Live community.

With respect to your query, you can create new notification for Agent Audit Logs. (Settings>Configurations>Notifications) 

Create new configuration and Select log type "Agent Audit Logs" and filter like "Result = Fail and Type = Installation"

XDR are able send notifications via either email or syslog.

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

[dahang]

Hello Dbahuguna,

I'm already aware of that, but the filter's element are missing.

I want to get notify on a specific endpoint group name. + don't want to be spam if the endpoint keep trying to upgrade and failed.

[jmazzeo · Accepted solution]

Hi @dahang, this is an example of what you are trying to achieve using XQL:

dataset = endpoints
| fields endpoint_name , operating_system , agent_version , last_seen , endpoint_status , operational_status , last_seen, last_upgrade_failure_reason, last_upgrade_status, last_upgrade_source, group_names
| filter (group_names contains """YOUR_GROUP_NAME""")
| filter last_upgrade_status = "FAILED"

You can save this as a Custom Widget for any dashboard and then create a report from it.

Let me know if this work for you.

Thanks

JM

[dahang]

Hello Jmazzeo,

That is perfect.

thank you