XQL Creation time filter

[Chamindu]

dataset = alerts

I need to filter alerts using XQL. However, when I use the above query in the usual format, it filters alerts based on the last update time. What I actually need is to filter alerts based on their creation time. How can I do that?

[aspatil · Accepted solution]

Hello @Chamindu ,

In Alerts dataset, it doesn't filters alerts based on the last update time. In Incidents dataset, _time refers to last updated time and in Alerts dataset it refers to Alert generation time on source origin. Please refer to below:

_time: represents the timestamp of the actual event that triggered the alert.
event_timestamp:Also denotes the timestamp of the event related to the alert, typically mirroring the _time field.
Arrival_time: Indicates the time when the alert was ingested into the Cortex XDR system. (edited) 

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/Overview-of-the-Alert...

You can simply sort using _time field and you will get the alerts based on Creation time.

If you feel this has answered your query, please let us know by clicking like and  on "mark this as a Solution". Thank you.

[Chamindu]

OK thank your reply. how can this apply to incident filter using XQL query for creation time.

dataset = incidents