Who rated this post

Hi @F.Roa422053 

Im not sure what do you exactly mean by baseline in this use case, neither sure what you want to achieve as a correlation baseline. 

Baseline as the meaning of the word is not possible in the way you mention in XDR.

However, reading your question in the later stages, it appears you want to query mutually inclusive data from both, endpoints and alert datasets. 

There is a join function in XQL that you can use to query both datasets independently and join the result into a new custom dataset. 
Please check out the doc: 

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-3.x-Documentation/join

Im gonna give you an example that you can modify as per your needs:

config timeframe = 7d
|dataset = alerts
| fields host_name , host_ip , host_os , agent_os_sub_type , alert_source
| join type = right (dataset = endpoints | filter endpoint_status in (ENUM.CONNECTED , ENUM.DISCONNECTED )| fields endpoint_name , ip_address , operating_system , platform ) as foo foo.endpoint_name = host_name
| comp count(alert_source ) as counter by endpoint_name
| filter counter < 5

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis