XQL Query to view the "Incident Name"

[JBahardeen]

Hi People, 

I was wondering if anyone could assist me with XQL Query to display the Incident name. Please refer to the attached photo to get an idea of what I am trying to achieve. I have used the xdr_data dataset, however i cannot find the relevant field. Appreciate anyone's support. 

Please note you are posting a public message where community members and experts can provide assistance. Sharing private information such as serial numbers or company information is not recommended.

[neelrohit]

Hi @JBahardeen ,

Cortex XDR XQL shows raw data only. Incidents and alerts are events created by processing and stitching raw logs which we see in XQL and hence they are not exposed as of now with the capability to run queries on incidents and alerts.

As a result, this is not possible,

Regards.

[JBahardeen]

Hi @neelrohit , 
Thank you for the prompt response and clarification. So just to confirm, it is impossible to achieve what is shown in the image and only through a feature request we could display the Incident "Description" ? and also The widget is created by PAN Internally ?

[bbarmanroy]

That's right. The incidents/alerts dataset is not exposed over XQL.

[JBahardeen]

Thanks for the clarification everyone !

I will reach out to your Customer Success Teams or TAC team to raise a feature request. 

[ShahrukhReza]

I think this Top 10 Incidents provides list of last 24 hrs incidents only , can you help me how to get data for last 30 days.

[Binetou_Lo]

Hello,

I have the same question.  I understand that it is not possible to create custom dashboard and reports based on incidents and alerts. For large company with multiple entities it is a must for me.