Using XDR Asset Inventory and XQL to report of machines without Cortex installed

[Claude_Schwab]

Hello All

I would like to use Asset Inventory to provide a list of each machine with os Windows and without Cortex agent installed.

The goal is to use the result in a widget for the dashboard if possible. Even better would be an api to use it with our monitoring software PRTG.

I am new to XQL and have not managed to create a query for the host_inventory dataset. 

Thank you in advance for your help

[nsinghvirk]

Hello @Claude_Schwab ,

Thanks for reaching out on LiveCommunity.

You can create a correlation rule or query that should identify the assets without XDR agent installed. Dataset you need is "panw_network_mapper_raw", which contain output of Network Mapper scans. You can compare this dataset with "endpoints" dataset mainly with reference to IP address. So basically, first dataset will have complete list of assets (For given IP range in Network Mapper scan) and you can subtract assets from second dataset which are having agent installed on them.

Below is an example query that you can refer and build something according to your use case.

dataset = panw_network_mapper_raw
| filter ip not in (dataset = endpoints | arrayexpand ip_address |fields ip_address )
|fields ip,hostname  

Please refer below document for XQL queries.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-XQL-Language-Reference/Get-Started-...

[AlexHalbarth]

Hello,

Thank you for the idea with the Network Mapper.
Is there a possibility to search the Asset Inventory tables too? Since they are populated anyways by Firewall Logs ingested, they should already contain all the assets without the need for manual scans by the Network Mapper.

Thanks and kind regards,

Alexander

[nsinghvirk]

Hello @AlexHalbarth 

Thanks for reaching out on LiveCommunity!

Unfortunately there is no dataset available for asset inventory.

Data in asset inventory comes from a number of sources like Network mapper, XDR agent, EDR data from firewalls and logs from third party vendor. You can write query against these data sources and use functions like join and union to build your use case.