KB KB5022661

[M.Rivera653095]

Hello,

Does anyone have a Cortex XDR query to check if any endpoints and/or servers are missing Microsoft KB5022661.  Any assistance would be greatly appreciated

[susekar]

Hello @M.Rivera653095 ,

Greetings for the day.

To identify endpoints and servers missing Microsoft KB5022661, you can use Cortex XDR Query Language (XQL) to search through Host Inventory data. Identifying missing patches typically requires a negative search, where you compare the total list of endpoints against those that have the specific KB installed.

---

XQL Query: Identifying Missing KB5022661

The most reliable method is to perform a left join between the complete endpoints dataset and the host_inventory_kbs preset.

dataset = endpoints 
| filter endpoint_status != ENUM.CONNECTION_LOST
| join conflict_strategy = left type = left 
    (preset = host_inventory_kbs | filter hotfix_id == "KB5022661") as kbs 
    kbs.endpoint_id = endpoint_id
| alter found = if(kbs.hotfix_id != null, 1, 0)
| comp sum(found) as total_found by endpoint_name, endpoint_id
| filter total_found == 0
| fields endpoint_name, endpoint_id

---

Alternative XQL Method: Expanding the KB Array

You can also query the host_inventory dataset directly by expanding the kbs array and filtering for hosts where the target KB is not present:

dataset = host_inventory 
| fields agent_id, host_name, kbs
| arrayexpand kbs 
| alter kb_id = json_extract_scalar(to_json_string(kbs), "$.hotfix_id")
| alter is_target = if(kb_id == "KB5022661", 1, 0)
| comp sum(is_target) as kb_check by host_name, agent_id
| filter kb_check == 0

---

Alternative: Azure Code Signing (ACS) Diagnostic Script

KB5022661 is specifically required to support Azure Code Signing (ACS), which is a prerequisite for newer Cortex XDR agent versions (for example, 8.8 and above).

• The test_acs Script:
  You can run the test_acs diagnostic script from the Cortex XDR script library on endpoints. If the script returns False, it confirms that the necessary ACS support (such as KB5022661 or a superseding update) is missing.

• Result Visibility:
  Script execution results are stored in the Action Center and are not queryable natively via XQL by default. To query these results centrally, you would need to use XSOAR to retrieve the results via API and ingest them into a custom XQL dataset.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Happy New year!!

Thanks & Regards,
S. Subashkar Sekar