Please help with, Cortex XDR query to efficiently filter incidents with high and medium severity with artifact.

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Please help with, Cortex XDR query to efficiently filter incidents with high and medium severity with artifact.

L1 Bithead

Hi Family , 

Please provide a Cortex XDR  query to efficiently filter incidents with high and medium severity, including artifacts, dates, endpoint names, and IP addresses.

Cortex XDR 



L4 Transporter

Hello @Prashanta ,


Thanks for reaching out on LiveCommunity!


You can use below example as the template, explore the dataset fields and modify the query as per your requirement.


dataset = incidents
| fields creation_time , incident_id , name , assigned_user , alert_sources , severity , status
| join type = inner (dataset = incidents_artifacts | fields incident_id , artifact_id , artifact_type , file_sha256 , file_wildfire_verdict , network_remote_ip ) as inid inid.incident_id = incident_id
| join type = inner (dataset = incidents_assets | fields incident_id , hostname , os , username ) as inid inid.incident_id = incident_id


If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

Ashutosh Patil

L5 Sessionator

Hi @Prashanta , 




Thank you for writing to live community!


Since the alert and incidents are two different datasets comprising different fields, we need to have develop XQL query to join the common fields and stages associated to these two datasets to have values appended as per the join strategies. Though we also have two other datasets incidents_artifacts and incidents_assets, it would still not contain the initiator and data associated to alerts context


The Cortex XDR XQL has a join stage which can be used for this purpose. 


Since the idea is to view the artefacts associated to alerts like initiators and processes and other parameters in the alert fields, a sample query can be used as below. Please note that this will list all the incidents and their associated alert artifacts for the alerts which will group into incidents only. You can add as many available fields you would want as per your choice and filter stages as per the severity of incident or alert as you like:



dataset = incidents 
| fields creation_time , alert_count , alert_sources , description ,score, alert_categories , severity , status ,  mitre_tactics_id_and_name , incident_id 
| join type = inner (dataset = alerts | filter severity in (ENUM.CRITICAL , ENUM.HIGH , ENUM.LOW , ENUM.MEDIUM )| fields alert_source ,alert_name, host_name , host_ip , user_name , initiated_by , initiator_path , initiator_cmd , initiator_sha256 ,target_process_name , target_process_cmd , target_process_sha256 , severity , category ,os_parent_user_name , module, mitre_attack_tactic , event_timestamp , _time , resolution_status , incident_id  ) as panw incident_id = panw.incident_id 




Hope this helps!


Please mark the response as "Accept as Solution" if it answers your query.



  • 2 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!