topic Re: XQL Query in Cortex XDR Discussions

XQL Query

Jai_Prakas — Mon, 12 Jan 2026 09:29:47 GMT

Can we fetch grouped issues by the help of XQL query. Like if same issues is running again and again in short period of time than that comes with +1 or +2 on console. So can we able to find that +1 or +2 issues which is grouped in a single issues through the help of XQL Query.

Re: XQL Query

susekar — Mon, 12 Jan 2026 14:18:15 GMT

Hello @Jai_Prakas ,

Greetings for the day!

Yes, you can fetch grouped issues (alerts) that appear with the "+n" tag (e.g., +1, +2) on the console by using an XQL query.

Understanding the "+n" Behavior

The "+n" tag is part of the Cortex XDR/XSIAM Alert Aggregation logic. When duplicate alerts (same alert name, same host) occur within a 24-hour period, the platform aggregates them into a single alert and appends the "+n" suffix to the alert name to indicate the number of additional occurrences. This behavior typically applies to alerts from firewalls, WildFire, and Local Analysis events.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Happy New Year!!

Thanks & Regards,
S. Subashkar Sekar

Re: XQL Query

Jai_Prakas — Tue, 13 Jan 2026 05:47:22 GMT

Will you help me the Query as when i 'm looking by dataset=alerts, not able to get proper visibility for it in XQL query.

Kindly help me with the query which i have to run for that.

Thanks and regards

Jai prakash