topic Re: Exporting alert related data in Cortex XDR Discussions

Exporting alert related data

MithunKT — Thu, 28 Jul 2022 07:07:36 GMT

Hi All,

Is there a way to export all the alert data which appears below Causality chain like network connections, registry changes, etc ?

I don't see any download or export icon on the right-hand side of the pane.

Do we have any other way to export these data?

Thanks!!

Please note you are posting a public message where community members and experts can provide assistance. Sharing private information such as serial numbers or company information is not recommended.

Re: Exporting alert related data

creddy — Thu, 28 Jul 2022 12:02:01 GMT

Hi @MithunKT You would be able to retrieve alert data by selecting an existing alert only.

To retrieve the alert data follow the documentation here: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-prevent-admin/investigation-and-response/investigate-endpoint-alerts/manage-alerts.html
See section Retrieve Additional Alert Details
In Step 2 - follow the Retrieve alert data section
Once in new tab(pivot to view Additional data) right click, then Download Files

Re: Exporting alert related data

bbarmanroy — Fri, 29 Jul 2022 01:59:55 GMT

Hi @MithunKT what is the use case you're trying to achieve by exporting the data? Is the end goal to ingest into a SIEM?

Re: Exporting alert related data

MithunKT — Fri, 29 Jul 2022 08:25:05 GMT

Hi @bbarmanroy it was for analysis and Investigation purposes. We got an incident from Analytics alert source stating internal scanning was observed, on checking the alert data we found multiple failed network connections from a single host towards multiple internal Destinations.

We just wanted to pass on this data (List of destinations, protocols) everything to the network team but exporting option was not available.

So how do we export the data in these scenarios? We can't give access to the XDR console to our network team but they should be given alert data in csv or tsv format.

Thanks!!

Re: Exporting alert related data

bbarmanroy — Mon, 01 Aug 2022 04:05:53 GMT

You can run a XQL query to retrieve the information and export the data to pass to your n/w Ops team.

You can also leverage the Network Connections in Query Builder to identify connections.

The results can be downloaded in TSV format and shared across other teams.