topic Re: XQL query for complete beginner in Cortex XDR Discussions

XQL query for complete beginner

RichardAntrobus — Fri, 08 Mar 2024 13:23:35 GMT

Hello, i'm trying to create an XQL query that will show all alerts, as opposed to incidents. Is that possible?

jmazzeo — Fri, 08 Mar 2024 13:31:45 GMT

Hi @RichardAntrobus, thanks for reaching us using the Live Community.

Yes, that's possible, there is a dataset called "alerts" that contains all the tenant alerts from Low to Critical severities.

Here is an example to show only the critical, you can remove the "filter" stage to show all the alerts if you want.

dataset = alerts | filter severity = ENUM.CRITICAL

If this post answers your question, please mark it as the solution.

RichardAntrobus — Fri, 08 Mar 2024 13:45:19 GMT

Thank you, that's very helpful!

EnderSandidge — Thu, 27 Mar 2025 20:37:59 GMT

Is there a way to make this work for informational alerts as well?

jmazzeo — Thu, 27 Mar 2025 20:45:58 GMT

No, the informational alerts are not available in the dataset, unless they are part of an Incident.

EnderSandidge — Thu, 27 Mar 2025 20:59:22 GMT

So there is no way to access those informational alerts if they are not pulled for an incident?