XQL query checking BitLocker status

[Piotr_Kowalczyk]

Hi,

I can see BitLocker status in Dashboard -> Endpoint -> Disk Encryption Visibility, but when I try to do the same with XQL query, I wasn't able to find Columns Status in any of preset or dataset. Can somebody help me with this please? I would like to add BitLocker status to my report.

[jmazzeo]

Hi @Piotr_Kowalczyk, thanks for reaching us using the Live Community.

You can get a quick view on the encryption status using the XQL Query:

dataset = endpoints
| fields encryption_status, endpoint_name 

Add any required filter and/or fields to that query to match your requirements.

If this post answers your question, please mark it as the solution.

[Piotr_Kowalczyk]

Hi Jmazzeo,

Thank you for your reply.

Sadly this solution doesn't work for me as we don't manage encryption with Cortex so the result of this query is NOT_CONFIGURED for all endpoints. I can see what I'm looking for in the column "VOLUMES STATUS" but I can't find this data using XQL query.

[jmazzeo · Accepted solution]

In that case, if you don't use the XDR Drive Encryption management you can't access to the status using XQL. That information is only available on the UI, it is not published to a dataset at the moment.

[Piotr_Kowalczyk]

thank you