XQL to get details of endpoints installed in last 12 hrs

[Shahwaz_Md]

Hi Team,

Need to build a report, hence need help with the XQL query to get the endpoints installed in the last 12 hrs.

Regards,

Shahwaz

[jmazzeo · Accepted solution]

Hi @Shahwaz_Md, thanks for reaching us using the Live Community.

Please try this query, you can change or add the fields as you need:

dataset = endpoints 
| filter timestamp_diff(current_time(),first_seen,"hour")<=12
| fields endpoint_name, operating_system, os_version , agent_version , content_version, user , ip_address

Let me know if this works. Thanks

[Shahwaz_Md]

Thanks!! It works

[aspatil]

Hello Shahwaz,

Apart from this you can create a report by going to Dashboard & Repors --> Report templates--> New Template.

Look for Number of installed agents in the Widgets Library and configured the same as per your requirements.