Reg: Display Callouts for Cortex XDR graph

[Kavurisowmya]

How can I get callout values in front of the row (count Example:1478)like below for a graph while creating an Xql query in Cortex XDR?

Cortex XDR 

[jtalton]

Hi Kavurisowmya,

You may try this query using the dataset=alerts which will provide a list of alerts that are only a part of an incident. You may also filter by the desired Actions:

dataset = alerts
| fields alert_id, incident_id, severity, alert_source, action
| filter incident_id != null // only show alerts that are part of incidents
| filter (action != N_A)

You may also use top stage to return the approximate count as shown in your screenshot:

| top action top_count as Alerts, top_percent as Percentage_of_XDR_Agent_Alerts
| alter Percentage_of_XDR_Agent_Alerts = divide(to_integer(multiply(Percentage_of_XDR_Agent_Alerts, 100)), 100)

Please note that XQL training is available in Beacon:

• Cortex XDR: XQL Syntax Basics - (Link)
• Cortex XDR: XQL Building Blocks - (Link)
• Cortex XDR: XQL Functions - (Link)

If you found this answer helpful, please select Accept as Solution.

Thank you