Queries about different operating system and the hours of attention to incidents

[Rolando_Pena]

Hello everyone,

I am trying to create some XQL queries to create some dashboards but without success. I wanted to know if you could help me, the questions would be the following:

1. that the different operating systems are shown, but that it shows if the computer is W7, W11, WS2012, WS2016, Ubuntu, MAC, etc. There is a query but it only shows if the computers are on a Windows, Linux or Mac platform. I would like to know what version it is.

2. Create a dashboard that shows the hours of attention to incidents, this to know what time of day the incidents are being closed, if this could be in a 24-hour format it would be great.

Thank you very much for helping me with these queries.

#XQL #queries

[nsinghvirk]

Hello @Rolando_Pena 

Thanks for reaching out on LiveCommunity!

I tried to create the XQL query according to your use cases. These queries give you the fields that provide the required  information.

1. dataset= endpoints
| fields endpoint_name , operating_system , os_version 

2. dataset = incidents
| filter status contains "RESOLVED*"
| fields status , creation_time , resolve_comment , resolved_ts , incident_id 

Please click Accept as Solution to acknowledge that the answer to your question has been provided.