Create report that shows new incidents based on a specific Incident Source

[Bojan-Totic]

Hey!

We have different teams looking at different incident sources.

Is there a way to report a widget or report that displays new incidents coming in for a specific Incident Source?

Example:

Only XDR Analytic BIOC alerts would show up in this fashion in a widget or report, rather than ever Incident:

Kind Regards,

Bojan

[afurze · Accepted solution]

Hi Bojan-Totic,

Unfortunately, at this time, Incidents and Alerts are not exposed as a dataset and therefor cannot be queried using XQL.  The only available dashboard and report widgets related to these are those that come out-of-the-box.  That being said, you can query Incidents and Alerts via the public API so you could import this data into another reporting tool to produce what you are looking for.

[Bojan-Totic]

Thank you for the reply Afurze! Appreciate it. 🙂