Showing results for 
Show  only  | Search instead for 
Did you mean: 

Who rated this post

Yes.. use below query.

dataset = panw_network_mapper_raw

| filter ip not in (dataset = endpoints | arrayexpand ip_address |fields ip_address )

|fields ip,hostname


This will give you hosts that don't have xdr agent.  Use filters as per your need.

Who rated this post