XQL to query Indicators

Bar_Magnezi — Wed, 11 Jun 2025 04:42:17 GMT

Hi ,
I want to create a Dashboard widget that shows a pie graph for indicators. There is the built in widget "indicatorsByVerdict" but I want to create something a bit different. I couldn't find a way to figure that out.

Re: XQL to query Indicators

A.Elzedy — Thu, 12 Jun 2025 14:22:49 GMT

Hi @Bar_Magnezi ,

As far as I'm aware, the threat intelligence logs are not searchable using xql which is required to create new custom widgets, however, you still have some alternative options; to look them up within the threat intelligence tab -> indicators,

https://pu.xdr.us.paloaltonetworks.com/threat-intel/indicators

You may apply some filtering, or export them in a CSV format

if you're not getting overall view by default, you may change it through an icon at the top right

topic XQL to query Indicators in Cortex XSIAM Discussions

XQL to query Indicators

Re: XQL to query Indicators