https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/verdict-of-vt-and-wildfire/m-p/505979#M2274 <P>Hello Team,</P><P>&nbsp;</P><P>From XDR console, we wanted to export alerts includes verdict from WildFire and Virus Total which we are not getting.</P><P>&nbsp;</P><P>Can anyone help me with XQL query or other way to get verdict (<STRONG>for e.g. Process: Excel.exe WF Verdict: Benign and VT score 0/65</STRONG>) includes in exported alerts.&nbsp;</P><P>&nbsp;</P><P><LI-PRODUCT title="Cortex XDR" id="Cortex_XDR"></LI-PRODUCT>&nbsp;</P> Fri, 24 Jun 2022 09:17:25 GMT Jaitapkar 2022-06-24T09:17:25Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/verdict-of-vt-and-wildfire/m-p/505979#M2274 <P>Hello Team,</P><P>&nbsp;</P><P>From XDR console, we wanted to export alerts includes verdict from WildFire and Virus Total which we are not getting.</P><P>&nbsp;</P><P>Can anyone help me with XQL query or other way to get verdict (<STRONG>for e.g. Process: Excel.exe WF Verdict: Benign and VT score 0/65</STRONG>) includes in exported alerts.&nbsp;</P><P>&nbsp;</P><P><LI-PRODUCT title="Cortex XDR" id="Cortex_XDR"></LI-PRODUCT>&nbsp;</P> Fri, 24 Jun 2022 09:17:25 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/verdict-of-vt-and-wildfire/m-p/505979#M2274 Jaitapkar 2022-06-24T09:17:25Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/verdict-of-vt-and-wildfire/m-p/506402#M2284 <P>Hi&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/224606">@Jaitapkar</a>&nbsp;<BR /><SPAN>You can get the WF verdict with artefact details&nbsp; from the corresponding&nbsp;</SPAN><A href="https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-api/cortex-xdr-apis/incident-management/get-extra-incident-data" target="_blank" rel="noopener">XDR API</A></P><DIV class="">&nbsp;</DIV><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="bbarmanroy_2-1656323637737.png" style="width: 570px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/41995i156B0E90FF86AC85/image-dimensions/570x591/is-moderation-mode/true?v=v2" width="570" height="591" role="button" title="bbarmanroy_2-1656323637737.png" alt="bbarmanroy_2-1656323637737.png" /></span></P><P>&nbsp;</P><P><U>Response of XDR API</U></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="bbarmanroy_3-1656323669753.png" style="width: 565px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/41996iBC68A2BB537601D3/image-dimensions/565x549/is-moderation-mode/true?v=v2" width="565" height="549" role="button" title="bbarmanroy_3-1656323669753.png" alt="bbarmanroy_3-1656323669753.png" /></span></P><P>&nbsp;</P><DIV class="">&nbsp;</DIV><P>&nbsp;</P> Mon, 27 Jun 2022 09:55:16 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/verdict-of-vt-and-wildfire/m-p/506402#M2284 bbarmanroy 2022-06-27T09:55:16Z