Widget Library XQL Query

PA_nts — Tue, 23 Jul 2024 07:45:50 GMT

Hi All,

So in the xsiam portal under 'Dashboard and reports' there is a pre-defined list of Widgets in the library..

Within the 'system monitoring' library there is a widget called 'daily consumption' which is great to identify data sources ingestion per day/week/month etc..

Question - anyone know how I can retrieve the actual xql query for thiswidget as I would like to create a custom widget but with alterations on this specific query.

thanks in adv

Re: Widget Library XQL Query

afurze — Tue, 23 Jul 2024 14:59:39 GMT

Hi PA_nts,

First, since this is not your first time posting here, I strongly encourage you to reach out to your Customer Success team for an introduction as they can more quickly handle your questions than posting here.

That being said, the queries for OOTB widgets are not exposed (and often do not use XQL but rather query the backend BigQuery database directly). You can query the metrics_source dataset which contains all the ingest volumes in 5-minute increments per datasource.

As an example, this query will show you your ingest from Prisma Cloud in one hour increments for the past week:

config timeframe = 7d | dataset = metrics_source | filter _collector_type = "Prisma Cloud" | bin _time span = 1h | comp sum(total_size_bytes) as total_size_bytes by _time

topic Re: Widget Library XQL Query in Cortex XSIAM Discussions

Widget Library XQL Query

Re: Widget Library XQL Query