How to find the assets that do not have XDR agent installed in new Cortex 4.x version ?

[A.Babu458463]

Hi,

earlier in the old Cortex 3.x version, it was easier to list out the assets that do not have Cortex XDR agent installed, from Asset Inventory (from the boolean value : Has_XDR_Agent as shown in the attachment).

Is this feature removed from the new Cortex version as it is not listed in the 4.x documentation and as 'Asset inventory' has been removed?

Please provide a solution to get a list of all assets without XDR agent.

Best regards,

A.Babu458463

[susekar]

Hello @A.Babu458463 ,

Greetings for the day.

In Cortex XDR 4.x and newer versions, the explicit "Has XDR Agent" column and filter have been removed from the user interface as part of a UI redesign and the transition to the Unified Asset Inventory (UAI) data model. While the specific boolean field is no longer available, the functionality has been migrated to the Identifier field.

Solution to List Assets Without Cortex XDR Agent

To identify unmanaged assets (those without an agent installed), you must now filter for assets where the unique agent identifier is absent.

1. Navigate to the Asset Inventory:
   Go to Inventory → Assets → All Assets (in version 4.3+, the URL is typically /assets/inventory).
2. Apply the Filter:
   • Click the Add Filters button.
   • Select the Identifier field from the list.
   • Apply the condition: Identifier contains no value.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Happy New Year!!

Thanks & Regards,
S. Subashkar Sekar