Get all chain of process related to causalty actor

Bouzeghoub — Wed, 14 Jan 2026 09:03:10 GMT

Hi,

Please, can we get all chain of process related to casualty actor via XQL.

For Example👇

BR.

Re: Get all chain of process related to causalty actor

susekar — Wed, 14 Jan 2026 14:57:26 GMT

Hello @Bouzeghoub ,

Greetings for the day.

To retrieve the full chain of process events related to a causality actor (Causality Group Owner or CGO) via XQL, you must use the definitive causality_id field within the xdr_data dataset.

While alert APIs provide metadata like actor_process_instance_id, they do not return the entire event graph. The causality_id is the primary identifier that links all raw events—including process executions, network connections, and file activities—that constitute the entire causality chain.

Recommended XQL Query

To see the process lineage, use the following query structure

dataset = xdr_data 
| filter causality_id = "[INSERT_CAUSALITY_ID_HERE]" 
| filter event_type = ENUM.PROCESS
| fields _time, agent_hostname, actor_process_image_name, actor_process_command_line, action_process_image_name, action_process_image_command_line, causality_actor_process_image_name
| sort asc _time

Key Fields for Analyzing the Chain

causality_id: The unique ID linking every event in the specific causality group.
actor_process_image_name: The process that initiated the action (the "parent" or "initiator").
action_process_image_name: The process that is being executed or targeted (the "child" or "target").
causality_actor_process_image_name: The name of the root process (CGO) that started the entire chain.
actor_process_instance_id and action_process_instance_id: Unique IDs for specific process instances used to map exact nodes in the hierarchy.

How to Find the Causality ID

If you are starting from a specific alert and want to move to XQL:
1. Locate the alert in the Alerts or Incidents table.
2. The causality_id can be found in the alert metadata (often listed as actor_causality_id).
3. Alternatively, you can right-click an event in the UI and select View in XQL to see the raw data, where the causality_id field will be populated for that event.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Happy New Year!!

Thanks & Regards,
S. Subashkar Sekar

Re: Get all chain of process related to causalty actor

Bouzeghoub — Thu, 15 Jan 2026 06:31:28 GMT

Thank you @susekar, but we want to see all chain related with causality.

Please see the image above.

BR.

topic Re: Get all chain of process related to causalty actor in Cortex XDR Discussions

Get all chain of process related to causalty actor

Re: Get all chain of process related to causalty actor

Recommended XQL Query

Key Fields for Analyzing the Chain

How to Find the Causality ID

Re: Get all chain of process related to causalty actor