https://live.paloaltonetworks.com/t5/cortex-xsiam-discussions/xql-query-for-a-correlation-rules/m-p/999612#M125 <P>I am trying to write a xql query for a correlation rule in which alert or incident will trigger for below condition.<BR />Condition:</P> <P>Threshold:&nbsp;Only once on match&nbsp;2</P> <P>Detect on unique values of:&nbsp;hostname<BR /><BR />So, my question is. how to write "Detect on unique values of:&nbsp;hostname" in a xql query?&nbsp;<BR />Please help me with a sample XQL search or syntax in XSIAM.<BR /><BR />Best Regards,<BR />Ankit</P> Thu, 26 Dec 2024 09:13:39 GMT a.anand354984 2024-12-26T09:13:39Z https://live.paloaltonetworks.com/t5/cortex-xsiam-discussions/xql-query-for-a-correlation-rules/m-p/999612#M125 <P>I am trying to write a xql query for a correlation rule in which alert or incident will trigger for below condition.<BR />Condition:</P> <P>Threshold:&nbsp;Only once on match&nbsp;2</P> <P>Detect on unique values of:&nbsp;hostname<BR /><BR />So, my question is. how to write "Detect on unique values of:&nbsp;hostname" in a xql query?&nbsp;<BR />Please help me with a sample XQL search or syntax in XSIAM.<BR /><BR />Best Regards,<BR />Ankit</P> Thu, 26 Dec 2024 09:13:39 GMT https://live.paloaltonetworks.com/t5/cortex-xsiam-discussions/xql-query-for-a-correlation-rules/m-p/999612#M125 a.anand354984 2024-12-26T09:13:39Z