Investigate contributing events - Administrator Guide - Cortex XDR - Cortex - Security Operations

When managing alerts generated by a correlation rule, you can view all the events created for this alert. You can have up to 1000 events per correlation rule. In addition, if the alert generated for this correlation rule includes a drilldown query, you can run the query in the Query Builder. A drilldown query provides additional information about the alert for further investigation.

The drilldown XQL query can accept parameters from the alert output for the correlation rule. In addition, the alert time frame used to run the drilldown query provides more details about the alert generated by the correlation rule. The alert time frame is the minimum and maximum timestamps of the events for the alert. If there is only one event, the event timestamp is the time frame used for the query.