Vuln drivers - scan

[tlmarques]

Hi,

Anyone know if is possible to retrieve the devices with drivers with vulnerabilities?
I've a lot devices with Cortex XDR and my objective is force IT guys, update vulnerable drivers etc.

[nar]

Hi @tlmarques 

Thanks for your query on LC!

XDR offers built in rules which basically detects and reports vulnerable drivers so one way I could think of is building an XQL to filter the hosts that have these "Vulnerable driver loaded" alerts and we can also run a query to list all the unsigned drivers to investigate on.

Give a like or mark as solution if this suggestion helped.

Best,
Naveen

[tlmarques]

@nar  thnks, i know that, my problem is, it dont see the filter in XQL for "description"