Report XQL Bitlocker

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Report XQL Bitlocker

L0 Member


I created a report to display computers with Bitlocker that is not compliant :

config case_sensitive = false | dataset = endpoints | filter encryption_status = ENUM.APPLYING or encryption_status = ENUM.NOT_COMPLIANT | filter endpoint_type = ENUM.TYPE_WORKSTATION | fields endpoint_name 

 When I test with real data, for example, it report 14 endpoints, but into the PDF report, it only show the first 3 endpoints, even it display that it found 14 results, it only print the 3 first endpoint name.

Any idea why ?



Best regards


L4 Transporter

Hi @lstaub, thanks for reaching us using the Live Community.


Are you using the same timeframe in the report and in the XQL Query? Maybe the report takes a shorter time than the query and that's why the result is different.


If this post answers your question, please mark it as the solution.


L1 Bithead

PDF reports are generally terrible in cortex XDR, rendering is just awful with missing data. I suggest to make a custom widget with your query and then use it to produce and deliver CSV when you create and schedule report template. CSV seems to be much more reliable. 

  • 2 replies
  • 78 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!