Email alert when a device checks in?

[evansbc1]

Hello,

Can XDR send an email when a specific device checks in?

Thanks!

[aspatil]

Hello @evansbc1 ,

What is mean by device checks in ? Do you mean USB is plugged?

[evansbc1]

Hello Aspatil,

I mean can XDR send an email alert when a specific PC checks in with the XDR servers?

Thanks for your help.

[aspatil]

Why do you want to do that? This will be very noisy.   The Cortex XDR Agent performs a heartbeat or check in approximately every 5 minutes. 

[evansbc1]

Thanks for the heads up.  We only need to do this for one laptop.  We need to know when it comes online so we can find it.

[jmazzeo]

Hi @evansbc1, you could try a correlation rule using this XQL:

dataset = endpoints
| filter endpoint_status = ENUM.CONNECTED and endpoint_name = "YourHostname"

Schedule the rule to run every 10 minutes and you will have an alert when it's online. Then you can create an Automation Rule when this alert is generated, and send a notification email or slack message if you have it.

If this post answers your question, please mark it as the solution.