Malware scan report

[S.Rembhotkar]

Hello Folks

We are initiating malware scan on servers using cortex XDR.

We need report of all the successfully scan servers and failed along with malware found details.

Fields require : Host name ,  IP , Scan status , Scan start and End Data , Malware found 

Please help me with XQL query to generate the report or any other suitable method.

Thanks in advance

[susekar · Accepted solution]

Hello @S.Rembhotkar ,

Greetings for the response.

In Cortex XDR, there is no single historical scan report that combines scan start time, end time, and detected malware in one table. The information can be retrieved using the following methods:

1. XQL Query: Use the endpoints dataset to retrieve the current scan status and the last successful scan completion timestamp. Separate scan start and end times are not available in this dataset.
2. Action Center: For manually initiated malware scans, navigate to Incident Response → Action Center, locate the Malware Scan action, and select Additional Data to review scan results, status, errors, and detected malicious files.
3. Endpoint Management: Navigate to Endpoints → Endpoint Management and enable the Scan Status and Last Successful Scan columns to monitor endpoint scan status.

Note: Detected malware details must be reviewed separately through scan results or relevant security alerts.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar