Reg: Display Callouts for Cortex XDR graph

Kavurisowmya — Fri, 01 Dec 2023 07:01:53 GMT

How can I get callout values in front of the row (count Example:1478)like below for a graph while creating an Xql query in Cortex XDR?

Re: Reg: Display Callouts for Cortex XDR graph

jtalton — Tue, 05 Dec 2023 15:51:13 GMT

Hi Kavurisowmya,

You may try this query using the dataset=alerts which will provide a list of alerts that are only a part of an incident. You may also filter by the desired Actions:

dataset = alerts
| fields alert_id, incident_id, severity, alert_source, action
| filter incident_id != null // only show alerts that are part of incidents
| filter (action != N_A)

You may also use top stage to return the approximate count as shown in your screenshot:

| top action top_count as Alerts, top_percent as Percentage_of_XDR_Agent_Alerts
| alter Percentage_of_XDR_Agent_Alerts = divide(to_integer(multiply(Percentage_of_XDR_Agent_Alerts, 100)), 100)

Please note that XQL training is available in Beacon:

Cortex XDR: XQL Syntax Basics - (Link)
Cortex XDR: XQL Building Blocks - (Link)
Cortex XDR: XQL Functions - (Link)

If you found this answer helpful, please select Accept as Solution.

Thank you

topic Re: Reg: Display Callouts for Cortex XDR graph in Cortex XDR Discussions

Reg: Display Callouts for Cortex XDR graph

Re: Reg: Display Callouts for Cortex XDR graph