XQL Query - Union between Alerts and Incident datasets

[meanmach]

Hi

I want to write an XQL query wherein i will be able to get both details of incident and Alerts in one table.

I want to correlate Incident ID and Description with the tables found in Alert dataset like CGO, Initiated by, Action process etc

[nsinghvirk]

Hello @meanmach 

Thanks for reaching out on LiveCommunity.

You can achieve this using "join" stage which will combine data from both datasets. I have written an example query which you can modify according to your use case.

dataset=incidents
| fields incident_id, description as IncidentDesc
| join (dataset = alerts | fields incident_id , cgo_name , initiated_by , action_process_instance_id ) as abc abc.incident_id = incident_id
| fields incident_id , IncidentDesc , cgo_name , initiated_by , action_process_instance_id

Reference for join stage- https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-XQL-Language-Reference/Join

Please click Accept as Solution to acknowledge that the answer to your question has been provided.