12-26-2024 01:13 AM
I am trying to write a xql query for a correlation rule in which alert or incident will trigger for below condition.
Condition:
Threshold: Only once on match 2
Detect on unique values of: hostname
So, my question is. how to write "Detect on unique values of: hostname" in a xql query?
Please help me with a sample XQL search or syntax in XSIAM.
Best Regards,
Ankit
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
