Can Applications be filtered in some way in Cortex XDR report?

[milen.slavov]

Hello all! I hope your day is going well!

I wanted to know if Cortex XDR has the availability to filter applications in a report?

What my goal is : For example I have 20 systems. Is there any way that I can put a filter on them, to see what Applications those systems have?

For example, this is now happening with Groups. I can see what groups are assigned to those 20 systems. I would like to have the same with Applications.

Let say that I would like on this filter to be able to say "contains or does not contain" and then the application name in quesiton.

Thank you!

[nikoolayy1]

What about this?

Application Analysis

You can assess the vulnerability status of applications in your network using the Host inventory. Cortex XDR compiles an application inventory of all the applications installed in your network by collecting from each Cortex XDR agent the list of installed applications. For each application on the list, you can see the existing CVEs and the vulnerability severity score that reflects the highest NIST vulnerability score detected for the application. Any new application installed on the endpoint will appear in Cortex XDR within 24 hours. Alternatively, you can re-scan the endpoint to retrieve the most updated list.

Starting with macOS 10.15, Mac built-in system applications are not reported by the Cortex XDR agent and are not part of the Cortex XDR Application Inventory.

From Add-ons → Host Insights → Host Inventory, select Applications.

• To view the details of all the endpoints in your network on which an application is installed, right-click the application and select View endpoints.

• To view in-depth details about the application, left-click the application name.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Vulnerabili...

[milen.slavov]

• To view the details of all the endpoints in your network on which an application is installed, right-click the application and select View endpoints.
  
  This is basically what I had in mind, HOWEVER in this scenario, I will not be able to see which systems DON'T have this application?
  
  So going back to the main question, is there any way, that we can Filter this so that the end result is = We have 20 Systems and once we apply the filter, we are going to be able to see which of those 20 have the application and which don't. (I am giving 20 as an number as an example, in my scenario we are talking about "bit" more 🙂
  
  Thakn you!