Create a Search Query for Incidents - Administrator Guide - 8 - Cortex XSOAR - Cortex - Security Operations

In the query bar, type your search criteria.

By default, the query is -status:closed -category:job, which searches for categories other than jobs and not those that have been closed. You can add fields like severity or type to narrow your search to critical issues or issues of a certain type.

From the dropdown list, select the date range for which you want to search.

By default, it is the last 7 days.

To customize the table summary view, click the gear icon above the table.

To customize the chart panel, go to one of the charts and from the dropdown list select the desired chart.

To save the query do the following:

1. Click .

2. Type a name for the query.

3. Click Save.

To view all saved queries, click . The list of saved queries appears. You can mark a saved query as a default, or delete a query. To edit an existing saved query, create a new query and save it with the exact name of the query you want to replace.