Cortex XDR disconnected endpoints
A Job to periodically query disconnected Cortex XDR endpoints with a provided last seen time range playbook input. The Collected data, if found will be generated to a CSV report, including a detailed list of the disconnected endpoints. The report will be sent to the recipient's provided email addresses in the playbook input. The playbook includes an incident type with a dedicated layout to visualize the collected data. To set the job correctly, you will need to. 1. Create a new recurring job. 2. Set the recurring schedule. 3. Add a name. 4. Set type to Cortex XDR disconnected endpoints. 5. Set this playbook as the job playbook. https://xsoar.pan.dev/docs/incidents/incident-jobs The scheduled run time and the timestamp relative date should be identical, If the job is recurring every 7 days, the time range should be 7 days as well.
- Pack
- CortexXDR
- Tasks
- 11
Inputs
- LastSeenStartDate — Last seen start date, in relative timestamp - "1 Day" or "7 days"
- LastSeenEndDate — Last seen end date, in relative timestamp - "1 Day" or "7 days" For the current day use "0 days"
- Email — Email addresses to send the disconnected endpoints report.
- MessageBody — Body for the report email message.
Commands used
- closeInvestigation
- send-mail
- setIncident
- xdr-get-endpoints