Detect delete agent with XQL.

[mirtoghrulseyid]

I kindly ask for your assistance with an XDR XQL query language script to identify devices in the network that do not have the XDR agent installed. Additionally, it would be helpful if the users could be identified from AD or through the DHCP on the network."

[mavega · Accepted solution]

Hi,

Thanks for reaching out.

You can sort unmanaged devices on your network by configuring your networks parameters in Cortex, it will scan your environment and will let you know which assets are unmanaged.

This link can help you set up your networks parameters:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Configure-Y...

Alternatively, you can run this below script (this is just an example and you might need to modify it to adjust your needs):

config case_sensitive = false
| dataset = pan_dss_raw

| alter name = rtrim(name, "$")
| filter lowercase(name) not in (dataset = endpoints | fields endpoint_name as jds_endpoint_name | alter jds_endpoint_name = lowercase(jds_endpoint_name))

| filter OS in("*Windows*", "*Linux*", "*Mac*")

| fields Name, OS, Os_Ver, last_modified_dc_record, domain_name, DN

| alter time_range = timestamp_diff(current_time(), last_modified_dc_record, "DAY")
| filter time_range < 60
| sort desc last_modified_dc_record

| dedup Name

If this solutions solves your issue please mark it as solved.

Regards.

[mirtoghrulseyid]

thanks for helping