topic Cortex XDR Timeline to XQL in Cortex XDR Discussions

Cortex XDR Timeline to XQL

paIoaItonetworks — Mon, 09 Sep 2024 07:20:56 GMT

Hi,

For our SOC report, we want to have this table with the average statistics of last week's monitoring, including average time to assign, time to respond etc. Is there a way to extract these timestamps from the incident's timeline on XQL and therefore make a custom widget? If not, what kind of bypass are there? Thanks in advance.

Re: Cortex XDR Timeline to XQL

nsinghvirk — Mon, 09 Sep 2024 15:48:58 GMT

Hello @paIoaItonetworks ,

Thanks for reaching out on LiveCommunity!

Below is a reference query which you can use and build up your use case. It gives you Time to assignment of incidents and Time to resolution of incidents.

dataset = incidents
| alter TimeToAssign = timestamp_diff(first_assignment_ts ,creation_time,"MINUTE")
| alter HourToResolve = timestamp_diff(resolved_ts,creation_time,"HOUR")
| alter MinToResolve = timestamp_diff(resolved_ts,creation_time,"MINUTE")
| fields creation_time , resolved_ts , first_assignment_ts ,TimeToAssign , HourToResolve , MinToResolve

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

Re: Cortex XDR Timeline to XQL

paIoaItonetworks — Tue, 10 Sep 2024 05:43:51 GMT

There is no "first_assignment_ts" function in XQL

Re: Cortex XDR Timeline to XQL

arekf — Tue, 10 Sep 2024 05:51:33 GMT

Hi,
unfortunately I also don't see the "first_assignment_ts" value in the schema and this item from this query doesn't work for me,