Cortex XDR XQL Query

[C.Djoulah]

Hi, 
I wanna sort my query as operational_status in (UNPROTECTED, PARTIALLY_PROTECTED) everyday (Like from Monday to Sunday Statistics) 
My query looks like this 
config case_sensitive = false
| dataset = endpoints
| filter operational_status in (UNPROTECTED, PARTIALLY_PROTECTED)
| comp count(endpoint_name) as Number_of_endpoints 

[jmazzeo]

Hi @C.Djoulah, thanks for reachin us using the Live Community.

If I understand your question, you need some sort of timeline with how many endpoints are in UNPROTECTED or PARTIALLY_PROTECTED status each day of the week, am I right?

Thanks