Please help with, Cortex XDR query to efficiently filter incidents with high and medium severity with artifact.

[Prashanta]

Hi Family , 

Please provide a Cortex XDR  query to efficiently filter incidents with high and medium severity, including artifacts, dates, endpoint names, and IP addresses.

Cortex XDR 

regards 

[aspatil]

Hello @Prashanta ,

Thanks for reaching out on LiveCommunity!

You can use below example as the template, explore the dataset fields and modify the query as per your requirement.

dataset = incidents
| fields creation_time , incident_id , name , assigned_user , alert_sources , severity , status
|filter severity in(ENUM.CRITICAL ,ENUM.HIGH ,ENUM.MEDIUM )
| join type = inner (dataset = incidents_artifacts | fields incident_id , artifact_id , artifact_type , file_sha256 , file_wildfire_verdict , network_remote_ip ) as inid inid.incident_id = incident_id
| join type = inner (dataset = incidents_assets | fields incident_id , hostname , os , username ) as inid inid.incident_id = incident_id

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

[neelrohit]

Hi @Prashanta , 

Greetings!

Thank you for writing to live community!

Since the alert and incidents are two different datasets comprising different fields, we need to have develop XQL query to join the common fields and stages associated to these two datasets to have values appended as per the join strategies. Though we also have two other datasets incidents_artifacts and incidents_assets, it would still not contain the initiator and data associated to alerts context

The Cortex XDR XQL has a join stage which can be used for this purpose. 

Since the idea is to view the artefacts associated to alerts like initiators and processes and other parameters in the alert fields, a sample query can be used as below. Please note that this will list all the incidents and their associated alert artifacts for the alerts which will group into incidents only. You can add as many available fields you would want as per your choice and filter stages as per the severity of incident or alert as you like:

dataset = incidents 
| fields creation_time , alert_count , alert_sources , description ,score, alert_categories , severity , status ,  mitre_tactics_id_and_name , incident_id 
| join type = inner (dataset = alerts | filter severity in (ENUM.CRITICAL , ENUM.HIGH , ENUM.LOW , ENUM.MEDIUM )| fields alert_source ,alert_name, host_name , host_ip , user_name , initiated_by , initiator_path , initiator_cmd , initiator_sha256 ,target_process_name , target_process_cmd , target_process_sha256 , severity , category ,os_parent_user_name , module, mitre_attack_tactic , event_timestamp , _time , resolution_status , incident_id  ) as panw incident_id = panw.incident_id 

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.