topic Re: Create report that shows new incidents based on a specific Incident Source in Cortex XDR Discussions

Create report that shows new incidents based on a specific Incident Source

Bojan-Totic — Tue, 12 Jul 2022 19:15:53 GMT

Hey!

We have different teams looking at different incident sources.

Is there a way to report a widget or report that displays new incidents coming in for a specific Incident Source?

Example:

Only XDR Analytic BIOC alerts would show up in this fashion in a widget or report, rather than ever Incident:

Kind Regards,

Bojan

Re: Create report that shows new incidents based on a specific Incident Source

afurze — Tue, 12 Jul 2022 19:47:55 GMT

Hi Bojan-Totic,

Unfortunately, at this time, Incidents and Alerts are not exposed as a dataset and therefor cannot be queried using XQL. The only available dashboard and report widgets related to these are those that come out-of-the-box. That being said, you can query Incidents and Alerts via the public API so you could import this data into another reporting tool to produce what you are looking for.

Re: Create report that shows new incidents based on a specific Incident Source

Bojan-Totic — Thu, 14 Jul 2022 17:26:00 GMT

Thank you for the reply Afurze! Appreciate it. 🙂