XQL query Help for custom XQL widgets

Patrice_De_Marconnay — Tue, 10 Jan 2023 09:36:08 GMT

Hello

I would like to customize the standard "Detections By Actions" widget to filter only on true positive (resolved) incidents - for the last 30 days.

And I would like to customize the standard "Open incidents by severity" widget to apply on all incidents, not only opened ones - for the last 30 days.
I suppose it's possible by XQL-query but I'm a beginner in XQL-query scripting ...
Does anyone have XQL-query script doing something nearby ?

Best regards
Patrice, France

Re: XQL query Help for custom XQL widgets

zarnous — Wed, 11 Jan 2023 17:16:16 GMT

For the time being , XQL doesn't support Incident and Alerts ingestion on XDR platform, hence, creating a custom widget related to incidents is currently not an option with Cortex XDR; however this option is available with XSIAM where there is datasets for incidents and alerts

topic XQL query Help for custom XQL widgets in Cortex XDR Discussions

XQL query Help for custom XQL widgets

Re: XQL query Help for custom XQL widgets