https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/xdr-data-logs-ingestion-to-splunk/m-p/510722#M2452 <P>I am thinking of a way to bring in xdr_data dataset logs which we see in xdr query builder to splunk.</P> <P>As of now i am ingesting the alert and incident data from cortex xdr into splunk.</P> <P>Can anyone suggest, how i can achieve this?</P> <P>&nbsp;</P> Wed, 03 Aug 2022 18:10:36 GMT SanglapPatra 2022-08-03T18:10:36Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/xdr-data-logs-ingestion-to-splunk/m-p/510722#M2452 <P>I am thinking of a way to bring in xdr_data dataset logs which we see in xdr query builder to splunk.</P> <P>As of now i am ingesting the alert and incident data from cortex xdr into splunk.</P> <P>Can anyone suggest, how i can achieve this?</P> <P>&nbsp;</P> Wed, 03 Aug 2022 18:10:36 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/xdr-data-logs-ingestion-to-splunk/m-p/510722#M2452 SanglapPatra 2022-08-03T18:10:36Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/xdr-data-logs-ingestion-to-splunk/m-p/510731#M2454 <P>Hi&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/227514">@SanglapPatra</a>&nbsp;you can certainly do that with "<SPAN>PAN-XDR-EP-FRWRD</SPAN>" licenses, which allows you to ingest xdr_data dataset from a GCP bucket for SIEM ingestion. Please discuss with your Accounts team to get more clarification on this.</P> Thu, 04 Aug 2022 02:23:42 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/xdr-data-logs-ingestion-to-splunk/m-p/510731#M2454 bbarmanroy 2022-08-04T02:23:42Z