Search context data - Use Query to search for specific items in the context data of an incident or alert. - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

You can use Query to search within the context data JSON for specific items and expand nested keys. Open the context data panel for an alert or incident, as explained in Alert context data or Incident context data, and type in the Search field.

Example context:

{
  "HelloWorld": {
    "Alerts": [
      {
        "name": "Example 1",
        "alert_status": "ACTIVE"
      },
      {
        "name": "Example 2",
        "alert_status": "CLOSED"
      },
      {
        "name": "Example 3",
        "alert_status": "ACTIVE"
      }
    ]
  }
}

Search examples: