- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
03-07-2024 04:31 AM - edited 03-07-2024 04:33 AM
Hi @Prashanta ,
Greetings!
Thank you for writing to live community!
Since the alert and incidents are two different datasets comprising different fields, we need to have develop XQL query to join the common fields and stages associated to these two datasets to have values appended as per the join strategies. Though we also have two other datasets incidents_artifacts and incidents_assets, it would still not contain the initiator and data associated to alerts context
The Cortex XDR XQL has a join stage which can be used for this purpose.
Since the idea is to view the artefacts associated to alerts like initiators and processes and other parameters in the alert fields, a sample query can be used as below. Please note that this will list all the incidents and their associated alert artifacts for the alerts which will group into incidents only. You can add as many available fields you would want as per your choice and filter stages as per the severity of incident or alert as you like:
dataset = incidents
| fields creation_time , alert_count , alert_sources , description ,score, alert_categories , severity , status , mitre_tactics_id_and_name , incident_id
| join type = inner (dataset = alerts | filter severity in (ENUM.CRITICAL , ENUM.HIGH , ENUM.LOW , ENUM.MEDIUM )| fields alert_source ,alert_name, host_name , host_ip , user_name , initiated_by , initiator_path , initiator_cmd , initiator_sha256 ,target_process_name , target_process_cmd , target_process_sha256 , severity , category ,os_parent_user_name , module, mitre_attack_tactic , event_timestamp , _time , resolution_status , incident_id ) as panw incident_id = panw.incident_id
Hope this helps!
Please mark the response as "Accept as Solution" if it answers your query.