View

Cortex XDR XQL view stage configures the graphical display of the result set.

Synopsis

view highlight fields = <field1>[,<field2>,...] values = <value1>[,<value2>,...]

view graph = column|line|pie xaxis = <field1> 
     yaxis = <field2> [<optional parameters>]

Description

The

view()

stage configures graphical display of the result set. It can be used in two different ways.

If you use

highlight

, the

view

stage highlights specified strings that XDR finds on specified fields. The highlight values that you provide are performed as a substring search, so only partial value can be highlighted in the final results table.

If you use

graph

, the

view

stage creates a column, line, or pie chart based on the values found for the fields specified on the

xaxis

and

yaxis

parameters. In this mode,

view

also offers a large number of parameters that allow you to control colors, decorations, and other behavior used for the final chart.

If you use

graph

, the fields specified for

xaxis

and

yaxis

must be collatable or the query will fail.

Examples

Use the dedup stage collect unique combinations of

event_type

and

event_sub_type

values. Highlight the word "STREAM" when it appears in the result set.

dataset = xdr_data 
| fields event_type, event_sub_type 
| dedup event_type, event_sub_type by asc _time 
| view highlight fields = event_sub_type values = "STREAM"

Count the number of unique files accessed by each user, and show a column graph of the results. This query uses comp count_distinct to calculate the number of unique files per username.

dataset = xdr_data 
| fields actor_effective_username as username, action_file_path as file_path 
| filter file_path != null and username != null 
| comp count_distinct(file_path) as file_count by username 
| view graph type = column xaxis = username yaxis = file_count

Document:Cortex XDR™ XQL Language Reference

View

View

Synopsis

Description

Examples

Recommended For You

Document:Cortex XDR™ XQL Language Reference

View

View

Synopsis

Description

Examples

Recommended For You

Recommended Videos