About SilviuMihailDascalu

Hi @MithunKT ,   Thanks for posting to our Live Community discussion board. I would recommend creating a dynamic endpoint groups based on the filters instead.  Use the filters to define the criteria you want to use to dynamically populate an endpoint group. Dynamic groups support multiple criteria selections and can use  AND  or  OR  operators. For endpoint names and aliases, and domains and workgroups, you can use  *  to match any string of characters. As you apply filters,  Cortex XDR  displays any registered endpoint matches to help you validate your filter criteria.   Let me know if you have any questions or concerns!   Thanks, SIlviu ... View more

Hi @NathanBradley ,   Thanks for reaching out to Live Community discussion board.   1. Unfortunately there isn't a description available. We are working continuously in providing more insights in the XQL value definitions. This information is coming directly from Microsoft and you can identify the meaning of each value behind here.   2. You should be able to leverage the alter function in order to obtain your desired results. More information is available here.   e.g    | alter start_mode = replace(replace(replace( start_mode , "1", " Service Manual Start "),"2", " Service Manual Stop "), "3", "Service Automated")   Please let me know if you have any questions or concerns!   Thanks, Silviu ... View more