Queries about different operating system and the hours of attention to incidents

Rolando_Pena — Mon, 22 Jan 2024 20:39:39 GMT

Hello everyone,

I am trying to create some XQL queries to create some dashboards but without success. I wanted to know if you could help me, the questions would be the following:

1. that the different operating systems are shown, but that it shows if the computer is W7, W11, WS2012, WS2016, Ubuntu, MAC, etc. There is a query but it only shows if the computers are on a Windows, Linux or Mac platform. I would like to know what version it is.

2. Create a dashboard that shows the hours of attention to incidents, this to know what time of day the incidents are being closed, if this could be in a 24-hour format it would be great.

Thank you very much for helping me with these queries.

#XQL #queries

Re: Queries about different operating system and the hours of attention to incidents

nsinghvirk — Mon, 29 Jan 2024 11:58:07 GMT

Hello @Rolando_Pena

Thanks for reaching out on LiveCommunity!

I tried to create the XQL query according to your use cases. These queries give you the fields that provide the required information.

1. dataset= endpoints
| fields endpoint_name , operating_system , os_version

2. dataset = incidents
| filter status contains "RESOLVED*"
| fields status , creation_time , resolve_comment , resolved_ts , incident_id

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

topic Queries about different operating system and the hours of attention to incidents in Cortex XDR Discussions

Queries about different operating system and the hours of attention to incidents

Re: Queries about different operating system and the hours of attention to incidents