Cortex Insights [Agent Information]
This dashboard provides a consolidated view into the health, status, and configuration of Cortex agents across your environment. It highlights key metrics on agent protection status and operating system distribution, and identifies critical issues like prolonged disconnections, misconfigurations, and upgrade failures.
Cortex Insights ENABLED
Details
| ID | 92e0fe9748974f55a05e73b8c799f130 |
|---|---|
| From Version | 6.10.0 |
Widgets (11)
Agents without XDR Pro license
This widget lists endpoints that do not have XDR Pro capabilities enabled, showing the endpoint name, type, and assigned policy. Use this information to identify under-protected assets that lack advanced threat detection and response, highlighting potential gaps in your security posture.
Custom XQL table
dataset = endpoints | filter endpoint_status in (ENUM.CONNECTED, ENUM.DISCONNECTED) | filter is_edr_enabled = ENUM.NO | fields endpoint_name as name, endpoint_type as type, assigned_prevention_policy as Policy
Agents with Forensics license
This widget lists all managed endpoints with the forensics data collection capability enabled. This helps administrators track license deployment and ensure critical assets are prepared for in-depth incident investigation.
Custom XQL table
dataset = endpoints | filter endpoint_status in (ENUM.CONNECTED, ENUM.DISCONNECTED) | filter is_forensics_enabled != "FALSE" | fields endpoint_name as name, endpoint_type as type, assigned_prevention_policy as Policy
Endpoint OS distribution
This widget displays the distribution of operating systems across all managed endpoints. This allows you to quickly visualize your OS landscape to identify potential compliance issues or security risks associated with unsupported systems.
Custom XQL pie
dataset = endpoints | comp count() as total by platform, operating_system, os_version | sort desc total | view graph type = pie subtype = full xaxis = operating_system yaxis = total
Agents that are in Connection Lost state
This widget identifies agents that are currently unable to communicate with the platform, displaying the duration since they were last seen. Use this data to prioritize remediation efforts for offline agents, ensuring continuous security posture and visibility.
Custom XQL table
dataset = endpoints | filter endpoint_status in (ENUM.CONNECTION_LOST) | alter daysNotSeen = timestamp_diff(current_time(), last_seen, "DAY") | fields endpoint_name as name, endpoint_type as type, daysNotSeen, last_seen
Not fully protected endpoints
This widget displays the number of endpoints that are not fully protected, categorized by their operational status and platform. This insight helps security teams quickly identify and prioritize remediation for endpoints that have security coverage gaps.
Custom XQL pie
dataset = endpoints | fields endpoint_id, operational_status, platform | filter operational_status != ENUM.PROTECTED | comp count() as total by operational_status, platform | view graph type = pie subtype = full show_callouts = `true` xaxis = operational_status yaxis = total
Server Agents that are disconnected for more than 20 days
This widget displays all server agents that have been disconnected for 20 or more days. This data highlights significant visibility gaps, helping you identify unprotected servers or reclaim licenses from stale assets.
Custom XQL table
dataset = endpoints | filter endpoint_status in (ENUM.DISCONNECTED) and endpoint_type in (ENUM.TYPE_SERVER) | filter timestamp_diff(current_time(), last_seen, "DAY") >= 20 | alter daysNotSeen = timestamp_diff(current_time(), last_seen, "DAY") | fields endpoint_name as name, endpoint_type as type, daysNotSeen, last_seen
Agent failure - Failed upgrades (Last 30 days)
This widget lists endpoints that have experienced at least three agent upgrade failures within the last 30 days. This helps identify chronically failing endpoints to prioritize troubleshooting and ensure consistent security coverage across your organization.
Custom XQL table
dataset = agent_auditing | filter agent_auditing_type = ENUM.AGENT_AUDIT_INSTALLATION and agent_auditing_subtype = ENUM.AGENT_AUDIT_UPGRADE and agent_auditing_result = ENUM.AGENT_AUDIT_FAIL | comp count(endpoint_id) as endpoint_failure_Count by endpoint_id, endpoint_name | filter endpoint_failure_Count >=3 | alter excessive_upgrade_failures = if(endpoint_id in(dataset = endpoints | filter last_upgrade_status = "FAILED"| fields endpoint_id),true,false) | filter excessive_upgrade_failures = true | join type = left (dataset = endpoints | alter status_description = arraystring(arraydistinct(arraymap(json_extract_array(operational_status_description , "$."), json_extract_scalar("@element", "$.reason"))), " , ") | alter detailed_description = arraystring(arraydistinct(arraymap(json_extract_array(operational_status_description , "$."), json_extract_scalar("@element", "$.title"))), " , ") | fields endpoint_name, platform, operating_system, last_upgrade_failure_reason, status_description, detailed_description, agent_version, last_upgrade_status, last_upgrade_status_time, auto_upgrade_status, installation_package,endpoint_id ) as endpoint_fields endpoint_fields.endpoint_id = endpoint_id
Prevention profiles configured without automatic Content Updates
This widget displays a count of endpoints with automatic content updates disabled, broken down by their assigned prevention policy. This insight helps administrators identify misconfigured policies that leave endpoints vulnerable to emerging threats.
Custom XQL pie
dataset = endpoints | filter content_auto_update = ENUM.DISABLED | comp count() as total by assigned_prevention_policy | view graph type = pie subtype = full xaxis = assigned_prevention_policy yaxis = total
Workstation Agents that are disconnected for more than 20 days
This widget displays workstation agents that have been disconnected for 20 days or more. This information helps identify unprotected endpoints that create security blind spots or indicate stale asset records.
Custom XQL table
dataset = endpoints | filter endpoint_status in (ENUM.DISCONNECTED) and endpoint_type in (ENUM.TYPE_WORKSTATION) | filter timestamp_diff(current_time(), last_seen, "DAY") >= 20 | alter daysNotSeen = timestamp_diff(current_time(), last_seen, "DAY") | fields endpoint_name as name, endpoint_type as type, daysNotSeen, last_seen
Reasons for not fully protected endpoints (Summary)
This widget displays a breakdown of endpoints that are not fully protected, categorized by the specific reason for their status. This insight allows security teams to prioritize remediation efforts by identifying the most prevalent issues affecting endpoint protection.
Custom XQL pie
config case_sensitive = false | dataset = endpoints | filter endpoint_status in (ENUM.CONNECTED, ENUM.DISCONNECTED) | filter operational_status != ENUM.PROTECTED | alter opstat_reason = arraymap (json_extract_array (to_json_string(operational_status_description),"$."), json_extract_scalar ("@element", "$.reason")) | arrayexpand opstat_reason | dedup endpoint_id, opstat_reason | comp count() as total by platform, opstat_reason | view graph type = pie subtype = full xaxis = opstat_reason yaxis = total
Reasons for not fully protected endpoints
This widget displays a list of endpoints that are not fully protected, itemizing the specific reason for their vulnerable status. This enables security teams to pinpoint prevalent protection gaps and prioritize remediation efforts across the organization.
Custom XQL table
config case_sensitive = false | dataset = endpoints | fields endpoint_name, endpoint_id, endpoint_status, operational_status, operational_status_description, platform | filter endpoint_status in (ENUM.CONNECTED, ENUM.DISCONNECTED) | filter operational_status != ENUM.PROTECTED | alter opstat_reason = arraymap (json_extract_array (to_json_string(operational_status_description),"$."), json_extract_scalar ("@element", "$.reason")) | arrayexpand opstat_reason | dedup endpoint_id, opstat_reason | fields endpoint_name, endpoint_id, endpoint_status, operational_status, opstat_reason, platform
{ "dashboards_data": [ { "id": "92e0fe9748974f55a05e73b8c799f130", "name": "Cortex Insights [Agent Information]", "description": "This dashboard provides a consolidated view into the health, status, and configuration of Cortex agents across your environment. It highlights key metrics on agent protection status and operating system distribution, and identifies critical issues like prolonged disconnections, misconfigurations, and upgrade failures.", "status": "ENABLED", "layout": [ { "id": "row-2252", "data": [ { "key": "xql_1770838262772", "data": { "type": "Custom XQL", "width": 33.333333333333336, "height": 511, "phrase": "dataset = endpoints\n | filter endpoint_status in (ENUM.CONNECTED, ENUM.DISCONNECTED)\n | filter is_edr_enabled = ENUM.NO\n | fields endpoint_name as name, endpoint_type as type, assigned_prevention_policy as Policy", "entityType": "xql-widget-table-98e9b8c7-bd85-4e66-810c-6b47a6be2200", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "table", "commands": [] }, "gridRawStorageInfo": { "sort": null, "coldefs": {}, "rowHeight": "{\"rowHeight\":\"regular\",\"gridRowsHeight\":\"medium-row\"}", "columnWidth": null } } }, { "key": "xql_1770838133923", "data": { "type": "Custom XQL", "width": 33.333333333333336, "height": 511, "phrase": "dataset = endpoints\n | filter endpoint_status in (ENUM.CONNECTED, ENUM.DISCONNECTED)\n | filter is_forensics_enabled != \"FALSE\"\n | fields endpoint_name as name, endpoint_type as type, assigned_prevention_policy as Policy\n", "entityType": "xql-widget-table-c6cd61e2-b2fd-4b01-8e8a-dfa59954e1e1", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "table", "commands": [] }, "gridRawStorageInfo": { "sort": null, "coldefs": {}, "rowHeight": "{\"rowHeight\":\"regular\",\"gridRowsHeight\":\"medium-row\"}", "columnWidth": null } } }, { "key": "xql_1770845902896", "data": { "type": "Custom XQL", "width": 33.333333333333336, "height": 511, "phrase": "dataset = endpoints | comp count() as total by platform, operating_system, os_version | sort desc total\n\n| view graph type = pie subtype = full xaxis = operating_system yaxis = total ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "pie", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "full" } }, { "command": { "op": "=", "name": "xaxis", "value": "operating_system" } }, { "command": { "op": "=", "name": "yaxis", "value": "total" } } ] } } } ] }, { "id": "row-8821", "data": [ { "key": "xql_1770835760483", "data": { "type": "Custom XQL", "width": 36.68303740083113, "height": 511, "phrase": "dataset = endpoints\n | filter endpoint_status in (ENUM.CONNECTION_LOST)\n | alter daysNotSeen = timestamp_diff(current_time(), last_seen, \"DAY\")\n | fields endpoint_name as name, endpoint_type as type, daysNotSeen, last_seen\n", "entityType": "xql-widget-table-1f85bf97-dc2b-43ea-8e7d-0141c4e6c135", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "table", "commands": [] }, "gridRawStorageInfo": { "sort": null, "coldefs": {}, "rowHeight": "{\"rowHeight\":\"regular\",\"gridRowsHeight\":\"medium-row\"}", "columnWidth": null } } }, { "key": "xql_1770863542166", "data": { "type": "Custom XQL", "width": 29.958443520967133, "height": 511, "phrase": "dataset = endpoints | fields endpoint_id, operational_status, platform | filter operational_status != ENUM.PROTECTED | comp count() as total by operational_status, platform\n\n| view graph type = pie subtype = full show_callouts = `true` xaxis = operational_status yaxis = total ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "pie", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "full" } }, { "command": { "op": "=", "name": "show_callouts", "value": "true" } }, { "command": { "op": "=", "name": "xaxis", "value": "operational_status" } }, { "command": { "op": "=", "name": "yaxis", "value": "total" } } ] } } }, { "key": "xql_1770863269058", "data": { "type": "Custom XQL", "width": 33.333333333333336, "height": 511, "phrase": "dataset = endpoints\n | filter endpoint_status in (ENUM.DISCONNECTED) and endpoint_type in (ENUM.TYPE_SERVER)\n | filter timestamp_diff(current_time(), last_seen, \"DAY\") >= 20\n | alter daysNotSeen = timestamp_diff(current_time(), last_seen, \"DAY\")\n | fields endpoint_name as name, endpoint_type as type, daysNotSeen, last_seen\n", "entityType": "xql-widget-table-12e576dd-785f-493f-900e-582202398ebf", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "table", "commands": [] }, "gridRawStorageInfo": { "sort": null, "coldefs": {}, "rowHeight": "{\"rowHeight\":\"regular\",\"gridRowsHeight\":\"medium-row\"}", "columnWidth": null } } } ] }, { "id": "row-480", "data": [ { "key": "xql_1770838476145", "data": { "type": "Custom XQL", "width": 100, "height": 511, "phrase": "dataset = agent_auditing | filter agent_auditing_type = ENUM.AGENT_AUDIT_INSTALLATION and agent_auditing_subtype = ENUM.AGENT_AUDIT_UPGRADE and agent_auditing_result = ENUM.AGENT_AUDIT_FAIL | comp count(endpoint_id) as endpoint_failure_Count by endpoint_id, endpoint_name | filter endpoint_failure_Count >=3 | alter excessive_upgrade_failures = if(endpoint_id in(dataset = endpoints | filter last_upgrade_status = \"FAILED\"| fields endpoint_id),true,false) | filter excessive_upgrade_failures = true | join type = left (dataset = endpoints | alter status_description = arraystring(arraydistinct(arraymap(json_extract_array(operational_status_description , \"$.\"), json_extract_scalar(\"@element\", \"$.reason\"))), \" , \") | alter detailed_description = arraystring(arraydistinct(arraymap(json_extract_array(operational_status_description , \"$.\"), json_extract_scalar(\"@element\", \"$.title\"))), \" , \") | fields endpoint_name, platform, operating_system, last_upgrade_failure_reason, status_description, detailed_description, agent_version, last_upgrade_status, last_upgrade_status_time, auto_upgrade_status, installation_package,endpoint_id ) as endpoint_fields endpoint_fields.endpoint_id = endpoint_id", "entityType": "xql-widget-table-90655417-ba95-40b6-8af5-671e70aacb73", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "table", "commands": [] }, "gridRawStorageInfo": { "sort": null, "coldefs": {}, "rowHeight": "{\"rowHeight\":\"regular\",\"gridRowsHeight\":\"medium-row\"}", "columnWidth": null } } } ] }, { "id": "row-4178", "data": [ { "key": "xql_1770863032764", "data": { "type": "Custom XQL", "width": 33.333333333333336, "height": 400, "phrase": "dataset = endpoints | filter content_auto_update = ENUM.DISABLED | comp count() as total by assigned_prevention_policy\n| view graph type = pie subtype = full xaxis = assigned_prevention_policy yaxis = total ", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "pie", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "full" } }, { "command": { "op": "=", "name": "xaxis", "value": "assigned_prevention_policy" } }, { "command": { "op": "=", "name": "yaxis", "value": "total" } } ] }, "gridRawStorageInfo": { "sort": null, "coldefs": {}, "rowHeight": "{\"rowHeight\":\"regular\",\"gridRowsHeight\":\"medium-row\"}", "columnWidth": null } } }, { "key": "xql_1770835832774", "data": { "type": "Custom XQL", "width": 33.333333333333336, "height": 400, "phrase": "dataset = endpoints\n | filter endpoint_status in (ENUM.DISCONNECTED) and endpoint_type in (ENUM.TYPE_WORKSTATION)\n | filter timestamp_diff(current_time(), last_seen, \"DAY\") >= 20\n | alter daysNotSeen = timestamp_diff(current_time(), last_seen, \"DAY\")\n | fields endpoint_name as name, endpoint_type as type, daysNotSeen, last_seen\n", "entityType": "xql-widget-table-ff0cd490-5e09-452f-b2f1-8be2afd87df3", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "table", "commands": [] }, "gridRawStorageInfo": { "sort": null, "coldefs": {}, "rowHeight": "{\"rowHeight\":\"regular\",\"gridRowsHeight\":\"medium-row\"}", "columnWidth": null } } }, { "key": "xql_1770845614269", "data": { "type": "Custom XQL", "width": 33.333333333333336, "height": 400, "phrase": "config case_sensitive = false | dataset = endpoints | filter endpoint_status in (ENUM.CONNECTED, ENUM.DISCONNECTED) | filter operational_status != ENUM.PROTECTED | alter opstat_reason = arraymap (json_extract_array (to_json_string(operational_status_description),\"$.\"), json_extract_scalar (\"@element\", \"$.reason\")) | arrayexpand opstat_reason | dedup endpoint_id, opstat_reason | comp count() as total by platform, opstat_reason\n\n| view graph type = pie subtype = full xaxis = opstat_reason yaxis = total ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "pie", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "full" } }, { "command": { "op": "=", "name": "xaxis", "value": "opstat_reason" } }, { "command": { "op": "=", "name": "yaxis", "value": "total" } } ] } } } ] }, { "id": "row-4176", "data": [ { "key": "xql_1770835608071", "data": { "type": "Custom XQL", "width": 100, "height": 400, "phrase": "config case_sensitive = false | dataset = endpoints | fields endpoint_name, endpoint_id, endpoint_status, operational_status, operational_status_description, platform | filter endpoint_status in (ENUM.CONNECTED, ENUM.DISCONNECTED) | filter operational_status != ENUM.PROTECTED | alter opstat_reason = arraymap (json_extract_array (to_json_string(operational_status_description),\"$.\"), json_extract_scalar (\"@element\", \"$.reason\")) | arrayexpand opstat_reason | dedup endpoint_id, opstat_reason | fields endpoint_name, endpoint_id, endpoint_status, operational_status, opstat_reason, platform\n", "entityType": "xql-widget-table-64096e51-fce0-4fa1-bbc5-c3d23235ce30", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "table", "commands": [] }, "gridRawStorageInfo": { "sort": null, "coldefs": {}, "rowHeight": "{\"rowHeight\":\"regular\",\"gridRowsHeight\":\"medium-row\"}", "columnWidth": null } } } ] } ], "default_dashboard_id": 1, "global_id": "92e0fe9748974f55a05e73b8c799f130", "metadata": { "params": [] } } ], "widgets_data": [ { "widget_key": "xql_1770838476145", "title": "Agent failure - Failed upgrades (Last 30 days)", "creation_time": 1771947009427, "description": "This widget lists endpoints that have experienced at least three agent upgrade failures within the last 30 days. This helps identify chronically failing endpoints to prioritize troubleshooting and ensure consistent security coverage across your organization.", "data": { "phrase": "dataset = agent_auditing | filter agent_auditing_type = ENUM.AGENT_AUDIT_INSTALLATION and agent_auditing_subtype = ENUM.AGENT_AUDIT_UPGRADE and agent_auditing_result = ENUM.AGENT_AUDIT_FAIL | comp count(endpoint_id) as endpoint_failure_Count by endpoint_id, endpoint_name | filter endpoint_failure_Count >=3 | alter excessive_upgrade_failures = if(endpoint_id in(dataset = endpoints | filter last_upgrade_status = \"FAILED\"| fields endpoint_id),true,false) | filter excessive_upgrade_failures = true | join type = left (dataset = endpoints | alter status_description = arraystring(arraydistinct(arraymap(json_extract_array(operational_status_description , \"$.\"), json_extract_scalar(\"@element\", \"$.reason\"))), \" , \") | alter detailed_description = arraystring(arraydistinct(arraymap(json_extract_array(operational_status_description , \"$.\"), json_extract_scalar(\"@element\", \"$.title\"))), \" , \") | fields endpoint_name, platform, operating_system, last_upgrade_failure_reason, status_description, detailed_description, agent_version, last_upgrade_status, last_upgrade_status_time, auto_upgrade_status, installation_package,endpoint_id ) as endpoint_fields endpoint_fields.endpoint_id = endpoint_id", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "table", "commands": [] }, "gridRawStorageInfo": { "sort": null, "coldefs": {}, "rowHeight": "{\"rowHeight\":\"regular\",\"gridRowsHeight\":\"medium-row\"}", "columnWidth": null } }, "support_time_range": true, "additional_info": { "query_tables": [ "endpoints", "agent_auditing" ], "query_uses_library": false } }, { "widget_key": "xql_1770835760483", "title": "Agents that are in Connection Lost state", "creation_time": 1771947008855, "description": "This widget identifies agents that are currently unable to communicate with the platform, displaying the duration since they were last seen. Use this data to prioritize remediation efforts for offline agents, ensuring continuous security posture and visibility.", "data": { "phrase": "dataset = endpoints\n | filter endpoint_status in (ENUM.CONNECTION_LOST)\n | alter daysNotSeen = timestamp_diff(current_time(), last_seen, \"DAY\")\n | fields endpoint_name as name, endpoint_type as type, daysNotSeen, last_seen\n", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "table", "commands": [] }, "gridRawStorageInfo": { "sort": null, "coldefs": {}, "rowHeight": "{\"rowHeight\":\"regular\",\"gridRowsHeight\":\"medium-row\"}", "columnWidth": null } }, "support_time_range": true, "additional_info": { "query_tables": [ "endpoints" ], "query_uses_library": false } }, { "widget_key": "xql_1770863269058", "title": "Server Agents that are disconnected for more than 20 days", "creation_time": 1771947010138, "description": "This widget displays all server agents that have been disconnected for 20 or more days. This data highlights significant visibility gaps, helping you identify unprotected servers or reclaim licenses from stale assets.", "data": { "phrase": "dataset = endpoints\n | filter endpoint_status in (ENUM.DISCONNECTED) and endpoint_type in (ENUM.TYPE_SERVER)\n | filter timestamp_diff(current_time(), last_seen, \"DAY\") >= 20\n | alter daysNotSeen = timestamp_diff(current_time(), last_seen, \"DAY\")\n | fields endpoint_name as name, endpoint_type as type, daysNotSeen, last_seen\n", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "table", "commands": [] }, "gridRawStorageInfo": { "sort": null, "coldefs": {}, "rowHeight": "{\"rowHeight\":\"regular\",\"gridRowsHeight\":\"medium-row\"}", "columnWidth": null } }, "support_time_range": true, "additional_info": { "query_tables": [ "endpoints" ], "query_uses_library": false } }, { "widget_key": "xql_1770845902896", "title": "Endpoint OS distribution", "creation_time": 1771947009651, "description": "This widget displays the distribution of operating systems across all managed endpoints. This allows you to quickly visualize your OS landscape to identify potential compliance issues or security risks associated with unsupported systems.", "data": { "phrase": "dataset = endpoints | comp count() as total by platform, operating_system, os_version | sort desc total\n\n| view graph type = pie subtype = full xaxis = operating_system yaxis = total ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "pie", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "full" } }, { "command": { "op": "=", "name": "xaxis", "value": "operating_system" } }, { "command": { "op": "=", "name": "yaxis", "value": "total" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "endpoints" ], "query_uses_library": false } }, { "widget_key": "xql_1770835608071", "title": "Reasons for not fully protected endpoints", "creation_time": 1771947010635, "description": "This widget displays a list of endpoints that are not fully protected, itemizing the specific reason for their vulnerable status. This enables security teams to pinpoint prevalent protection gaps and prioritize remediation efforts across the organization.", "data": { "phrase": "config case_sensitive = false | dataset = endpoints | fields endpoint_name, endpoint_id, endpoint_status, operational_status, operational_status_description, platform | filter endpoint_status in (ENUM.CONNECTED, ENUM.DISCONNECTED) | filter operational_status != ENUM.PROTECTED | alter opstat_reason = arraymap (json_extract_array (to_json_string(operational_status_description),\"$.\"), json_extract_scalar (\"@element\", \"$.reason\")) | arrayexpand opstat_reason | dedup endpoint_id, opstat_reason | fields endpoint_name, endpoint_id, endpoint_status, operational_status, opstat_reason, platform\n", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "table", "commands": [] }, "gridRawStorageInfo": { "sort": null, "coldefs": {}, "rowHeight": "{\"rowHeight\":\"regular\",\"gridRowsHeight\":\"medium-row\"}", "columnWidth": null } }, "support_time_range": true, "additional_info": { "query_tables": [ "endpoints" ], "query_uses_library": false } }, { "widget_key": "xql_1770835832774", "title": "Workstation Agents that are disconnected for more than 20 days", "creation_time": 1771947008010, "description": "This widget displays workstation agents that have been disconnected for 20 days or more. This information helps identify unprotected endpoints that create security blind spots or indicate stale asset records.", "data": { "phrase": "dataset = endpoints\n | filter endpoint_status in (ENUM.DISCONNECTED) and endpoint_type in (ENUM.TYPE_WORKSTATION)\n | filter timestamp_diff(current_time(), last_seen, \"DAY\") >= 20\n | alter daysNotSeen = timestamp_diff(current_time(), last_seen, \"DAY\")\n | fields endpoint_name as name, endpoint_type as type, daysNotSeen, last_seen\n", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "table", "commands": [] }, "gridRawStorageInfo": { "sort": null, "coldefs": {}, "rowHeight": "{\"rowHeight\":\"regular\",\"gridRowsHeight\":\"medium-row\"}", "columnWidth": null } }, "support_time_range": true, "additional_info": { "query_tables": [ "endpoints" ], "query_uses_library": false } }, { "widget_key": "xql_1770863032764", "title": "Prevention profiles configured without automatic Content Updates", "creation_time": 1771947008598, "description": "This widget displays a count of endpoints with automatic content updates disabled, broken down by their assigned prevention policy. This insight helps administrators identify misconfigured policies that leave endpoints vulnerable to emerging threats.", "data": { "phrase": "dataset = endpoints | filter content_auto_update = ENUM.DISABLED | comp count() as total by assigned_prevention_policy\n| view graph type = pie subtype = full xaxis = assigned_prevention_policy yaxis = total ", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "pie", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "full" } }, { "command": { "op": "=", "name": "xaxis", "value": "assigned_prevention_policy" } }, { "command": { "op": "=", "name": "yaxis", "value": "total" } } ] }, "gridRawStorageInfo": { "sort": null, "coldefs": {}, "rowHeight": "{\"rowHeight\":\"regular\",\"gridRowsHeight\":\"medium-row\"}", "columnWidth": null } }, "support_time_range": true, "additional_info": { "query_tables": [ "endpoints" ], "query_uses_library": false } }, { "widget_key": "xql_1770845614269", "title": "Reasons for not fully protected endpoints (Summary)", "creation_time": 1771947010305, "description": "This widget displays a breakdown of endpoints that are not fully protected, categorized by the specific reason for their status. This insight allows security teams to prioritize remediation efforts by identifying the most prevalent issues affecting endpoint protection.", "data": { "phrase": "config case_sensitive = false | dataset = endpoints | filter endpoint_status in (ENUM.CONNECTED, ENUM.DISCONNECTED) | filter operational_status != ENUM.PROTECTED | alter opstat_reason = arraymap (json_extract_array (to_json_string(operational_status_description),\"$.\"), json_extract_scalar (\"@element\", \"$.reason\")) | arrayexpand opstat_reason | dedup endpoint_id, opstat_reason | comp count() as total by platform, opstat_reason\n\n| view graph type = pie subtype = full xaxis = opstat_reason yaxis = total ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "pie", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "full" } }, { "command": { "op": "=", "name": "xaxis", "value": "opstat_reason" } }, { "command": { "op": "=", "name": "yaxis", "value": "total" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "endpoints" ], "query_uses_library": false } }, { "widget_key": "xql_1770838262772", "title": "Agents without XDR Pro license", "creation_time": 1771947009590, "description": "This widget lists endpoints that do not have XDR Pro capabilities enabled, showing the endpoint name, type, and assigned policy. Use this information to identify under-protected assets that lack advanced threat detection and response, highlighting potential gaps in your security posture.", "data": { "phrase": "dataset = endpoints\n | filter endpoint_status in (ENUM.CONNECTED, ENUM.DISCONNECTED)\n | filter is_edr_enabled = ENUM.NO\n | fields endpoint_name as name, endpoint_type as type, assigned_prevention_policy as Policy", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "table", "commands": [] }, "gridRawStorageInfo": { "sort": null, "coldefs": {}, "rowHeight": "{\"rowHeight\":\"regular\",\"gridRowsHeight\":\"medium-row\"}", "columnWidth": null } }, "support_time_range": true, "additional_info": { "query_tables": [ "endpoints" ], "query_uses_library": false } }, { "widget_key": "xql_1770838133923", "title": "Agents with Forensics license", "creation_time": 1771947009719, "description": "This widget lists all managed endpoints with the forensics data collection capability enabled. This helps administrators track license deployment and ensure critical assets are prepared for in-depth incident investigation.", "data": { "phrase": "dataset = endpoints\n | filter endpoint_status in (ENUM.CONNECTED, ENUM.DISCONNECTED)\n | filter is_forensics_enabled != \"FALSE\"\n | fields endpoint_name as name, endpoint_type as type, assigned_prevention_policy as Policy\n", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "table", "commands": [] }, "gridRawStorageInfo": { "sort": null, "coldefs": {}, "rowHeight": "{\"rowHeight\":\"regular\",\"gridRowsHeight\":\"medium-row\"}", "columnWidth": null } }, "support_time_range": true, "additional_info": { "query_tables": [ "endpoints" ], "query_uses_library": false } }, { "widget_key": "xql_1770863542166", "title": "Not fully protected endpoints", "creation_time": 1771947008528, "description": "This widget displays the number of endpoints that are not fully protected, categorized by their operational status and platform. This insight helps security teams quickly identify and prioritize remediation for endpoints that have security coverage gaps.", "data": { "phrase": "dataset = endpoints | fields endpoint_id, operational_status, platform | filter operational_status != ENUM.PROTECTED | comp count() as total by operational_status, platform\n\n| view graph type = pie subtype = full show_callouts = `true` xaxis = operational_status yaxis = total ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "pie", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "full" } }, { "command": { "op": "=", "name": "show_callouts", "value": "true" } }, { "command": { "op": "=", "name": "xaxis", "value": "operational_status" } }, { "command": { "op": "=", "name": "yaxis", "value": "total" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "endpoints" ], "query_uses_library": false } } ], "fromVersion": "6.10.0" }