Cortex XDR Incident - High

Original query, unchanged.

CortexXDR_Incidents_CL
| where severity_s contains "high"
| where status_s !contains "resolved_auto"
// the below line filters for incidents that has at least one user or one host in it. Comment the below line if you want to generated incidents that have 0 user or 0 host as well
| where host_count_d > 0 or user_count_d > 0
| project TimeGenerated, incident_id_s, status_s, severity_s, incident_sources_s, description_s, xdr_url_s, hosts_s, users_s, alert_categories_s, host_count_d, user_count_d, alert_count_d, creation_time_d, modification_time_d