Endpoint Console Events visibility on XDR Dashboard

[MayurLad]

Hi,

I need the events from the screenshot below to be visible from the Cortex XDR dashboard. Is there any XQL query that could showcase these events with the endpoints hostname?

[neelrohit · Accepted solution]

Hi @MayurLad ,

Incidents and alert data is not part of the XQL dataset to query upon. However, all of the events convert to XDR alerts and hence, you can navigate to alerts table to filter out all alerts from a particular hostname. 

You can use the filter as mentioned here: alert source=XDR Agent AND hostname="xxxx" Timestamp="<your choice of timestamp>"

Hope this helps!

[MayurLad]

I was able to find the required incidents.

Thank you @neelrohit