Querying Users Who Changed Incident Status to "Action Required"

[AvinashAddala]

Hi Team,

We have a process where a user works on an incident and updates its status to "Action Required" for further investigation. While we can see the identity of the user who made this change in the Timeline tab of each incident, reviewing this individually for 500–800 incidents is not feasible.

We would like to know if there is a way to filter or export a list of incidents along with the users who changed the status to "Action Required", ideally through a query or report in XSIAM.

Is there a method (e.g., using XQL, audit logs, or another feature) that can help us retrieve this information at scale?

Thank you