topic Re: How to Filter Incidents by Creation Time in XQL Within a Specific Timeframe? in Cortex XDR Discussions

How to Filter Incidents by Creation Time in XQL Within a Specific Timeframe?

Chamindu — Tue, 08 Apr 2025 07:17:56 GMT

I need to write an XQL query for a fortnightly report. The query I currently use is shown below, but it's incorrect for my purpose:

config timeframe between "2025-03-01 00:00:00 +0000" and "2025-03-15 23:59:59 +0000" | dataset = incidents | filter status in (ENUM.RESOLVED_FALSE_POSITIVE, ENUM.RESOLVED_TRUE_POSITIVE)

Although I have defined the timeframe, this query does not filter incidents created only within that timeframe. It includes incidents that may have been created outside the timeframe but were updated during the timeframe.

What I actually need is to filter and list only the incidents that were created during this specific timeframe (from March 1 to March 15, 2025)

Re: How to Filter Incidents by Creation Time in XQL Within a Specific Timeframe?

aspatil — Wed, 09 Apr 2025 13:19:01 GMT

You may try something like below:
dataset = incidents
| filter status in (ENUM.RESOLVED_FALSE_POSITIVE, ENUM.RESOLVED_TRUE_POSITIVE)
|filter creation_time >= "2025-03-01 00:00:00 +0000" and creation_time <="2025-03-15 23:59:59 +0000"
| fields incident_id, creation_time, status, severity, description

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

Re: How to Filter Incidents by Creation Time in XQL Within a Specific Timeframe?

Chamindu — Thu, 10 Apr 2025 05:09:59 GMT

This error occurs.