XQL Incident Count Doesn’t Match UI Incident Count — Same Date Range

[Chamindu]

Hi everyone,

I’m working on a report using Cortex XQL to count incidents created between March 15 and March 31, 2025.

Here’s the query I’m using:

config timeframe between "2025-03-15 00:00:00" and "2025-03-31 23:59:59"
| dataset = incidents
| filter creation_time >= "2025-03-15 00:00:00"
  and creation_time <  "2025-03-31 23:59:59"
| fields incident_id, creation_time

However, I’m getting different results:

• XQL query returns: 2,293 incidents

• UI shows: 2,347 incidents

Why would the XQL return less incidents than the UI, even with the same creation time range?
Are there hidden filters in the UI or something else I'm missing?

Any help would be appreciated!

[aspatil]

Hello @Chamindu ,

• UI Behavior: The Cortex XDR UI filters incidents based on the _time field, which represents the last update time of an incident. This means that incidents created before your specified date range but updated within it will still appear in the UI results.​

• XQL Query Behavior: Your XQL query filters incidents based on the creation_time field, capturing only those incidents that were created within the specified timeframe. This approach excludes incidents that were created earlier but updated during your date range.​

To align your XQL query results with the UI:

1. Adjust the Time Filter: Modify your XQL query to filter based on the _time field instead of creation_time. This change will include incidents that were updated within your specified date range, matching the UI behavior.​

   Updated Query:

   config timeframe between "2025-03-15 00:00:00" and "2025-03-31 23:59:59" | dataset = incidents | filter _time >= "2025-03-15 00:00:00" and _time <= "2025-03-31 23:59:59" | fields incident_id, _time

2. Clarify Reporting Requirements: If your reporting needs specifically require incidents based on their creation time, continue using the creation_time filter. However, be aware that this will result in a lower count compared to the UI, which includes updated incidents.

If you feel this has answered your query, please let us know by clicking like and  on "mark this as a Solution". Thank you.