Create notification/alerts for failed upgrade and outdated endpoint

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Create notification/alerts for failed upgrade and outdated endpoint

L1 Bithead

Hello,

 

I would like to be notify when an endpoint is outdated or when an upgrade failed.

I'm aware there is the notifications pages,

LIVEcommunity - Notification if Cortex XDR agent fails to upgrade - LIVEcommunity - 531271 (paloalto...

 

But there is not the filter that I want.  I want this only on a specific endpoint group name / tags.

My other fear is the fact that we will be spam if an endpoint try again and again to be upgrade and failed.

We can set it per day, but that can lead to an unreadable email.

 

I try to do it with the report schedule.

That is more complete, I can filter to the scope that I want, receive it per month.

Unfortunately, there is no widget to show what endpoint are outdated, have to create it from XQL widget.

but I'm only starting, I have some difficulties with XQL.

 

Does someone have a solution ?

 

Best regards

1 ACCEPTED SOLUTION

Accepted Solutions

L2 Linker

Hi @dahang, this is an example of what you are trying to achieve using XQL:

 

dataset = endpoints
| fields endpoint_name , operating_system , agent_version , last_seen , endpoint_status , operational_status , last_seen, last_upgrade_failure_reason, last_upgrade_status, last_upgrade_source, group_names
| filter (group_names contains """YOUR_GROUP_NAME""")
| filter last_upgrade_status = "FAILED"

 

You can save this as a Custom Widget for any dashboard and then create a report from it.

 

Let me know if this work for you.

 

Thanks

JM

JM

View solution in original post

4 REPLIES 4

L2 Linker

Hi @dahang ,

 

Thank you for reaching out to Palo Alto Live community.

 

With respect to your query, you can create new notification for Agent Audit Logs. (Settings>Configurations>Notifications) 

Create new configuration and Select log type "Agent Audit Logs" and filter like "Result = Fail and Type = Installation"

XDR are able send notifications via either email or syslog.

 

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

Hello Dbahuguna,

 

I'm already aware of that, but the filter's element are missing.

I want to get notify on a specific endpoint group name. + don't want to be spam if the endpoint keep trying to upgrade and failed.

L2 Linker

Hi @dahang, this is an example of what you are trying to achieve using XQL:

 

dataset = endpoints
| fields endpoint_name , operating_system , agent_version , last_seen , endpoint_status , operational_status , last_seen, last_upgrade_failure_reason, last_upgrade_status, last_upgrade_source, group_names
| filter (group_names contains """YOUR_GROUP_NAME""")
| filter last_upgrade_status = "FAILED"

 

You can save this as a Custom Widget for any dashboard and then create a report from it.

 

Let me know if this work for you.

 

Thanks

JM

JM

Hello Jmazzeo,

 

That is perfect.

thank you

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!