topic Re: XQL Creation time filter in Cortex XDR Discussions

XQL Creation time filter

Chamindu — Wed, 02 Apr 2025 06:14:31 GMT

dataset = alerts

I need to filter alerts using XQL. However, when I use the above query in the usual format, it filters alerts based on the last update time. What I actually need is to filter alerts based on their creation time. How can I do that?

Re: XQL Creation time filter

aspatil — Thu, 03 Apr 2025 09:37:52 GMT

Hello @Chamindu ,

In Alerts dataset, it doesn't filters alerts based on the last update time. In Incidents dataset, _time refers to last updated time and in Alerts dataset it refers to Alert generation time on source origin. Please refer to below:

_time: represents the timestamp of the actual event that triggered the alert.
event_timestamp:Also denotes the timestamp of the event related to the alert, typically mirroring the _time field.
Arrival_time: Indicates the time when the alert was ingested into the Cortex XDR system. (edited)

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/Overview-of-the-Alerts-page

You can simply sort using _time field and you will get the alerts based on Creation time.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

Re: XQL Creation time filter

Chamindu — Thu, 03 Apr 2025 13:03:30 GMT

OK thank your reply. how can this apply to incident filter using XQL query for creation time.

dataset = incidents