Query to Monitor Computer Uptime

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Query to Monitor Computer Uptime

L1 Bithead

 

Hello,

 

I intend to formulate a new query to retrieve the computer's uptime, and if the system has been active for more than 30 days, generate an alert. Although I attempted the following XQL Search, the outcome yielded no results:

 

config case_sensitive = false
| preset = xdr_event_log
| filter event_type = EVENT_LOG and action_evtlog_event_id in (6013) 
| fields action_evtlog_message as message, action_evtlog_event_id as event_id 

 

Can u help me, please

2 REPLIES 2

L3 Networker

Have you confirmed that the system uptime field is populated for any endpoints?  

 

None of our 4000+ endpoints show values in that field and I posted this question in December.

The response was it is only for iOS devices.

 

LIVEcommunity - System uptime field for Cortex Pro agents is empty. - LIVEcommunity - 568917 (paloal...

 

We have different inquiries and issues ;

 

  • While you utilize an add-on named "Host Insights" to retrieve your machine's uptime, someone mentions that it's not feasible because it's solely accessible for iOS
  • On my end, what I aim for is to extract the description of event 6013 from the event log using an XQL Search. If the value within the description exceeds 2,592e+6, I want to trigger an alert
  • 824 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!