Clients

Use the Text Search box to filter the devices listed in the inventory table according to the text you enter.

Note: The search box is not case-sensitive when using Basic Search.

For example:

• Enter “demo” and Cisco XDR devices filters through all the device information, including device name, user names seen, and so on. If any of the device information contains the text you entered, that device will appear in the inventory table.
• Filter devices based on IP address. Enter a partial or complete IP address and the inventory table is updated in real-time as you type. Type 192.168 in the search box, and the inventory table will list all the devices that contain 192.168.
• Get more specific by adding a third octet such as 26, and only devices that contain 192.168.26 will appear in the inventory table.

Boolean Operators

You can also use the Boolean operators AND, OR, and NOT. They can make each search more precise and save you time.

For example:

• Enter “demo OR phone” in the search box and the table shows you devices that have the word “demo” in their data and devices that have the word “phone” in their data. Entering “demo phone” generates the same result.
• Enter “demo AND phone” in the search box and the table shows you devices that have both the words “demo” and “phone” somewhere in their data.
• Enter “NOT demo” in the search box and the table shows you devices that do not have the word “demo” in their information.

Another way to filter is to include the criteria in these search categories using the Filters drawer. Click Filters to open the drawer.

Each criteria shows the number (in parentheses) of devices in inventory that match that criteria.

These categories offer criteria that you can check to include them in your filter:

• Managed Status

  Managed means it’s a device managed by a device manager that you have linked and that device manager reports that the device is being managed. Otherwise, if the device is marked as “Managed=No” in the device manager, it gets reflected as Unmanaged in device inventory.

• Operating System

• OS Support

  Cisco XDR can tell you when your operating systems are out-of-date or end-of-life for most of your devices. However, server platforms are excluded from this feature. Cisco XDR leverages a special feed from Duo Security, which provides OS lifecycle information, and applies it to its non-server device inventory. This does not require a Duo integration with Cisco XDR.

• Type

  server, desktop, virtual, mobile

• Device Value

  You can select multiple device values and if the value is assigned by default, manually, or a rule.

These categories offer criteria that you can set to Must Include to include that criteria in your filter, or conversely Must Exclude:

• Labels

• Sources

  The Cisco Secure Client (Unified Connector) source is always set to Must Include on the Clients page.

• Policies

• Source Groups/Tags

  Source groups and tags are imported from integrations with Cisco XDR. Currently, we import groups from Secure Endpoint and tags from Meraki.

• Deployment Configurations

These categories offer criteria where you select a start and end date to filter by the specified time range:

• Last Active

These categories offer a check box that you can check to include them in your filter:

• Not Seen in Over 7 Days
• Need Connector Update
• Has Faults
• AV Definitions out of date

Checks Across Multiple Categories

A filter with checks across multiple categories results in a Boolean AND operation. For example, this filter results in the inventory table showing only the devices that meet all the specified conditions:

• Text Search

  have the text “desktop” somewhere in their information

• Managed Status

  are Unmanaged

• Operating System

  are running Windows

Checks Within a Category

Multiple checks within the same category results in a Boolean OR operation in that category. For example, this filter results in the inventory table showing all the managed devices that are either running Windows or macOS:

• Managed Status

  are Unmanaged

• Operating System

  are running Windows

• Operating System

  are running macOS

These are just a few examples of how you can quickly search through your device inventory using the powerful filter to help you find what you’re looking for.

At any point, you can save the filter selection you’ve configured and pull it up to use again later, saving you the time of having to build it again. Click Add to Saved Filters to save it in your organization, and all users in the organization will be able to use that filter selection.

To conveniently use a saved filter again, select it from the Saved Filters drop-down list. This added flexibility enables you to continue your search later and pick up where you left off. You can also modify a filter to save a new version of it and share a common filter for use across your organization.

To delete a saved filter, click the Saved Filters drop-down list, then click the (Delete) icon. Click Delete to confirm.

You can scroll the list of devices using the scroll bar on the page or the up and down arrow keys on your keyboard. You can also edit the number of rows shown per page at the bottom of the table.

Note: If you have a large number of devices, selecting the last page of the table will cause a loading error to occur. Use filters to reduce the number of devices in the table to avoid the error.

Click the (missing or bad snippet) next to the column headers to sort the table by that column in ascending or descending order.

To reorder the table columns, click and drag a column header to the desired position in the table.

Click the (Select columns) icon to open the Select columns drawer and check the check boxes next to the columns you want displayed in the table.