Cortex XDR Timeline to XQL

[paIoaItonetworks]

Hi,

For our SOC report, we want to have this table with the average statistics of last week's monitoring, including average time to assign, time to respond etc. Is there a way to extract these timestamps from the incident's timeline on XQL and therefore make a custom widget? If not, what kind of bypass are there? Thanks in advance.

[nsinghvirk]

Hello @paIoaItonetworks ,

Thanks for reaching out on LiveCommunity!

Below is a reference query which you can use and build up your use case. It gives you Time to assignment of incidents and Time to resolution of incidents.

dataset = incidents
| alter TimeToAssign = timestamp_diff(first_assignment_ts ,creation_time,"MINUTE")
| alter HourToResolve = timestamp_diff(resolved_ts,creation_time,"HOUR")
| alter MinToResolve = timestamp_diff(resolved_ts,creation_time,"MINUTE")
| fields creation_time , resolved_ts , first_assignment_ts ,TimeToAssign , HourToResolve , MinToResolve

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

[paIoaItonetworks]

There is no "first_assignment_ts" function in XQL

[arekf]

Hi,
unfortunately I also don't see the "first_assignment_ts" value in the schema and this item from this query doesn't work for me,