Cortex XDR Incident - Medium

Requête originale, sans modification.

PaloAltoCortexXDR_Incidents
| where Severity contains "medium"
| where Status !contains "resolved_auto"
// the below line filters for incidents that has at least one user or one host in it. Comment the below line if you want to generated incidents that have 0 user or 0 host as well
| where HostCount > 0 or UserCount > 0
| extend Hosts_s = tostring(Hosts), Users_s = tostring(Users)
| project TimeGenerated, IncidentId, Status, Severity, IncidentSources, Description, XdrUrl, Hosts_s, Users_s, AlertCategories, HostCount, UserCount, AlertCount, CreationTime, ModificationTime