From 09b8477fad9de206460b10cb48c5631937a40e86 Mon Sep 17 00:00:00 2001
From: Kevin Logan <56395104+kevinlog@users.noreply.github.com>
Date: Wed, 12 Aug 2020 09:20:55 -0400
Subject: [PATCH] [SECURITY_SOLUTION] fix unenrolled query (#74798)

---
 .../server/endpoint/routes/metadata/support/unenroll.ts         | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/metadata/support/unenroll.ts b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/support/unenroll.ts
index 136f314aa415f..ca2ced177ab33 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/metadata/support/unenroll.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/support/unenroll.ts
@@ -19,7 +19,7 @@ export async function findAllUnenrolledAgentIds(
       perPage: pageSize,
       showInactive: true,
       kuery:
-        '(fleet-agents.packages : "endpoint" AND fleet-agents.active : false) OR (NOT fleet-agents.packages : "endpoint" AND fleet-agents.active : true)',
+        '(fleet-agents.active : false) OR (NOT fleet-agents.packages : "endpoint" AND fleet-agents.active : true)',
     };
   };