Report XQL Bitlocker

[lstaub]

Hello,

I created a report to display computers with Bitlocker that is not compliant :

config case_sensitive = false | dataset = endpoints | filter encryption_status = ENUM.APPLYING or encryption_status = ENUM.NOT_COMPLIANT | filter endpoint_type = ENUM.TYPE_WORKSTATION | fields endpoint_name 

 When I test with real data, for example, it report 14 endpoints, but into the PDF report, it only show the first 3 endpoints, even it display that it found 14 results, it only print the 3 first endpoint name.

Any idea why ?

Thanks

Best regards

[jmazzeo]

Hi @lstaub, thanks for reaching us using the Live Community.

Are you using the same timeframe in the report and in the XQL Query? Maybe the report takes a shorter time than the query and that's why the result is different.

If this post answers your question, please mark it as the solution.

[rufat87]

PDF reports are generally terrible in cortex XDR, rendering is just awful with missing data. I suggest to make a custom widget with your query and then use it to produce and deliver CSV when you create and schedule report template. CSV seems to be much more reliable.