Cortex XDR Query Builder

willh1 — Fri, 29 Jul 2022 15:46:03 GMT

Hello Community,

Was wondering whether someone could assit me with an issue.

So at the moment i cannot make any search via the "Query Builder".

When i move to query center and create a custom query i can only return results when i search "dataset = pan_ngfw"

when i enter a search for network story i get results but with barely any information (below)

I have checked that cortex data lake is sending all necsassary logs from fw (file_data, threat, traffic, global protect etc)

Can someone please adivse

Re: Cortex XDR Query Builder

mfakhouri — Wed, 03 Aug 2022 19:17:11 GMT

Hello @willh1,

If you have already confirmed that the Cortex Data Lake is sending the necessary logs (following the adequate procedures found at the documentation listed below), please ensure that you are able to view the firewall on the hub. From apps.paloaltonetworks.com/apps, navigate to the “Cortex Data Lake” app and ensure that your configured firewall is connected. This is indicated on the Inventory page with a green connected button under the "Connection Status" column.

Please ensure that you have an up-to-date Pro-per-TB license as well since it could be the case that you are not hitting a quota under Dataset Management with an expired license. Navigate to Configurations > Data Management > Dataset Management to view your quota under the "Storage License Details" and ensure it does not exceed as indicated by the graph.

Would you be able to provide the query you are searching with on the Query Builder or see if there are any results when utilizing the Network Connection query?

Relevant documentation:

Start sending logs to the Cortex Data Lake:

https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-started-with-cortex-data-lake/start-sending-logs-to-cortex-data-lake

View Data Lake Inventory to see if the Firewall is connected:

https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/monitor-cortex-data-lake/devices-tab

Data Management page:

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/data-management/dataset-management

topic Re: Cortex XDR Query Builder in Cortex XDR Discussions

Cortex XDR Query Builder

Re: Cortex XDR Query Builder