After deploying Cortex XDR agents to a large group of endpoints, some of the endpoints have a partially protected status. In which two places can insights into what is contributing to this status be…

Question

Options

• AManagement Audit Logs
• BXQL query of the endpoints dataset
• CAll Endpoints page
• DAsset Inventory

• A
  22% (5)
• B
  70% (16)
• D
  9% (2)

Explanation

When an endpoint shows partially protected status in Cortex XDR, the two places to investigate are the All Endpoints page (C) and an XQL query of the endpoints dataset (B). The All Endpoints page provides a filterable, visual breakdown of each endpoint's protection status, letting you drill into specific agents to see which modules or policies are incomplete. XQL queries against the endpoints dataset let you programmatically surface and correlate the exact fields (e.g., agent_status, policy_name, modules) contributing to the partial status across large fleets - essential when dealing with many endpoints at once.

Why the distractors are wrong:

• A (Management Audit Logs): These record administrator actions (logins, policy changes, etc.), not endpoint health or agent module states.
• D (Asset Inventory): This catalogs discovered assets broadly; it doesn't surface granular agent protection-status breakdowns or module-level issues.

Memory tip: Think "BC = Big Coverage" - the Big query (XQL) gives you depth across all endpoints, while the C (All Endpoints page) gives you a visual, per-endpoint summary. Both focus on agent state, which is where partial protection lives.

No community discussion yet for this question.