Cortex XDR Timeline to XQL

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Cortex XDR Timeline to XQL

L1 Bithead

Hi,

 

For our SOC report, we want to have this table with the average statistics of last week's monitoring, including average time to assign, time to respond etc. Is there a way to extract these timestamps from the incident's timeline on XQL and therefore make a custom widget? If not, what kind of bypass are there? Thanks in advance.

1 accepted solution

Accepted Solutions

There is no "first_assignment_ts" function in XQL

paIoaItonetworks_0-1725947018893.png

 

View solution in original post

3 REPLIES 3

L4 Transporter

Hello @paIoaItonetworks ,

 

Thanks for reaching out on LiveCommunity!

Below is a reference query which you can use and build up your use case. It gives you Time to assignment of incidents and Time to resolution of incidents.

dataset = incidents
| alter TimeToAssign = timestamp_diff(first_assignment_ts ,creation_time,"MINUTE")
| alter HourToResolve = timestamp_diff(resolved_ts,creation_time,"HOUR")
| alter MinToResolve = timestamp_diff(resolved_ts,creation_time,"MINUTE")
| fields creation_time , resolved_ts , first_assignment_ts ,TimeToAssign , HourToResolve , MinToResolve

 

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

There is no "first_assignment_ts" function in XQL

paIoaItonetworks_0-1725947018893.png

 

L0 Member

Hi,
unfortunately I also don't see the "first_assignment_ts" value in the schema and this item from this query doesn't work for me,

  • 1 accepted solution
  • 521 Views
  • 3 replies
  • 1 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!