Help - XQL Query for Unprotected assets

[BOtero1]

Hi, everyone.

I have a use case of creating a Correlation rule to track the asset where the operational status of the agent changed from "Protected" to "Unprotected". I am having a hard time building the actual query. Any ideas?

Im currently only tracking asset under "Unprotected" but that generates a lot of noise as any new deployment the initial status of the agent will be "Unprotected" therefore the alert will trigger. So this is not accurate at all.

Current query:

dataset = endpoints | filter endpoint_status = ENUM.CONNECTED and operational_status = "UNPROTECTED"
| dedup endpoint_id
| fields endpoint_id , endpoint_name , endpoint_type, endpoint_status, operational_status, operational_status_description, operating_system, ip_address, tags

[micomi · Accepted solution]

Hi

You could probably just filter out newly installed agents.

| alter install_date_difference = timestamp_diff(current_time(), install_date, "DAY") // calculate the amount of days since the XDR agent was installed.
| filter install_date_difference > 1 // Set/filter the amount of days when the correlation rule should trigger. In this example the agent needs to be installed for 2 days and more

timestamp_diff would also support the difference in hours.

Hope this helps

[BOtero1]

Amazing! Thanks! That works like a charm.