topic Endpoint Console Events visibility on XDR Dashboard in Cortex XDR Discussions

Endpoint Console Events visibility on XDR Dashboard

MayurLad — Fri, 27 Jan 2023 12:46:36 GMT

Hi,

I need the events from the screenshot below to be visible from the Cortex XDR dashboard. Is there any XQL query that could showcase these events with the endpoints hostname?

Re: Endpoint Console Events visibility on XDR Dashboard

neelrohit — Fri, 27 Jan 2023 13:00:39 GMT

Hi @MayurLad ,

Incidents and alert data is not part of the XQL dataset to query upon. However, all of the events convert to XDR alerts and hence, you can navigate to alerts table to filter out all alerts from a particular hostname.

You can use the filter as mentioned here: alert source=XDR Agent AND hostname="xxxx" Timestamp="<your choice of timestamp>"

Hope this helps!

Re: Endpoint Console Events visibility on XDR Dashboard

MayurLad — Mon, 30 Jan 2023 05:45:49 GMT

I was able to find the required incidents.

Thank you @neelrohit