Query to Monitor Computer Uptime

[Melvin_Machado]

Hello,

I intend to formulate a new query to retrieve the computer's uptime, and if the system has been active for more than 30 days, generate an alert. Although I attempted the following XQL Search, the outcome yielded no results:

config case_sensitive = false
| preset = xdr_event_log
| filter event_type = EVENT_LOG and action_evtlog_event_id in (6013) 
| fields action_evtlog_message as message, action_evtlog_event_id as event_id 

Can u help me, please

[PC-TomS]

Have you confirmed that the system uptime field is populated for any endpoints?  

None of our 4000+ endpoints show values in that field and I posted this question in December.

The response was it is only for iOS devices.

LIVEcommunity - System uptime field for Cortex Pro agents is empty. - LIVEcommunity - 568917 (paloal...

[Melvin_Machado]

We have different inquiries and issues ;

• While you utilize an add-on named "Host Insights" to retrieve your machine's uptime, someone mentions that it's not feasible because it's solely accessible for iOS
• On my end, what I aim for is to extract the description of event 6013 from the event log using an XQL Search. If the value within the description exceeds 2,592e+6, I want to trigger an alert