XQL query search for "Connection Lost" computers

[Piotr_Kowalczyk]

Hi,

I'm trying to find a query which will show me computers with status "Connection Lost".

Sadly I'm not able to do this in both preset = host_inventory  (can't find the computer which has this status in the Cortex Dashboard) as well as dataset = endpoints where I'm able to find the computer but there is no status in any column.

Could somebody advise please?

[jmazzeo · Accepted solution]

Hi @Piotr_Kowalczyk , thanks for reaching us using the Live Community.

Please try this XQL Query, add the fields as you need, and any other extra information thay you may require:

dataset = endpoints 
| filter endpoint_status = ENUM.CONNECTION_LOST 
| fields endpoint_name, ip_address, operating_system, agent_version, last_seen 

If this post answers your question, please mark it as the solution.

[Piotr_Kowalczyk]

It works - thank you!