https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/query-group-indicators-by-domain-name/m-p/554318#M2528 <P>dataset = host_users_to_groups <BR />| filter agent_domain = "abc.com"</P> Fri, 18 Aug 2023 14:53:31 GMT PC-TomS 2023-08-18T14:53:31Z https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/query-group-indicators-by-domain-name/m-p/553663#M2522 <P>If I have a tenant/account that has incidents.<BR /><BR />some of those incidents have indicators / entities tied to abc.com or xyz.com<BR /><BR />Is there a way to query for, show me all the incidents that have hostnames or account names that end in abc.com?<BR /><BR />Wasn't having luck in xsoar, so i switched over to kibana and our elastic database, but I don't see any of my indicators stored in elastic; are indicators not stored in elastic DB?<BR /><BR />Thanks in advance<BR /><BR /></P> Mon, 14 Aug 2023 18:37:23 GMT https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/query-group-indicators-by-domain-name/m-p/553663#M2522 JoshBoyd 2023-08-14T18:37:23Z https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/query-group-indicators-by-domain-name/m-p/554318#M2528 <P>dataset = host_users_to_groups <BR />| filter agent_domain = "abc.com"</P> Fri, 18 Aug 2023 14:53:31 GMT https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/query-group-indicators-by-domain-name/m-p/554318#M2528 PC-TomS 2023-08-18T14:53:31Z