XQL Query - Union between Alerts and Incident datasets

meanmach — Mon, 29 Apr 2024 07:22:53 GMT

I want to write an XQL query wherein i will be able to get both details of incident and Alerts in one table.

I want to correlate Incident ID and Description with the tables found in Alert dataset like CGO, Initiated by, Action process etc

Re: XQL Query - Union between Alerts and Incident datasets

nsinghvirk — Fri, 03 May 2024 02:29:27 GMT

Hello @meanmach

Thanks for reaching out on LiveCommunity.

You can achieve this using "join" stage which will combine data from both datasets. I have written an example query which you can modify according to your use case.

dataset=incidents
| fields incident_id, description as IncidentDesc
| join (dataset = alerts | fields incident_id , cgo_name , initiated_by , action_process_instance_id ) as abc abc.incident_id = incident_id
| fields incident_id , IncidentDesc , cgo_name , initiated_by , action_process_instance_id

Reference for join stage- https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-XQL-Language-Reference/Join

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

topic Re: XQL Query - Union between Alerts and Incident datasets in Cortex XDR Discussions

XQL Query - Union between Alerts and Incident datasets

Re: XQL Query - Union between Alerts and Incident datasets