topic Re: XQL Query to view the "Incident Name" in Cortex XDR Discussions

XQL Query to view the "Incident Name"

JBahardeen — Mon, 17 Oct 2022 08:15:45 GMT

Hi People,

I was wondering if anyone could assist me with XQL Query to display the Incident name. Please refer to the attached photo to get an idea of what I am trying to achieve. I have used the xdr_data dataset, however i cannot find the relevant field. Appreciate anyone's support.

Please note you are posting a public message where community members and experts can provide assistance. Sharing private information such as serial numbers or company information is not recommended.

Re: XQL Query to view the "Incident Name"

neelrohit — Mon, 17 Oct 2022 10:41:15 GMT

Hi @JBahardeen ,

Cortex XDR XQL shows raw data only. Incidents and alerts are events created by processing and stitching raw logs which we see in XQL and hence they are not exposed as of now with the capability to run queries on incidents and alerts.

As a result, this is not possible,

Regards.

Re: XQL Query to view the "Incident Name"

JBahardeen — Tue, 18 Oct 2022 22:51:20 GMT

Hi @neelrohit ,
Thank you for the prompt response and clarification. So just to confirm, it is impossible to achieve what is shown in the image and only through a feature request we could display the Incident "Description" ? and also The widget is created by PAN Internally ?

Re: XQL Query to view the "Incident Name"

bbarmanroy — Wed, 19 Oct 2022 05:43:59 GMT

That's right. The incidents/alerts dataset is not exposed over XQL.

Re: XQL Query to view the "Incident Name"

JBahardeen — Wed, 19 Oct 2022 05:48:02 GMT

Thanks for the clarification everyone !

I will reach out to your Customer Success Teams or TAC team to raise a feature request.

Re: XQL Query to view the "Incident Name"

ShahrukhReza — Fri, 17 Mar 2023 07:48:27 GMT

I think this Top 10 Incidents provides list of last 24 hrs incidents only , can you help me how to get data for last 30 days.

Re: XQL Query to view the "Incident Name"

Binetou_Lo — Tue, 29 Aug 2023 09:13:02 GMT

Hello,

I have the same question. I understand that it is not possible to create custom dashboard and reports based on incidents and alerts. For large company with multiple entities it is a must for me.