topic Re: Possible Values for event_types in Cortex XDR Discussions

Possible Values for event_types

sushant1601 — Wed, 24 May 2023 15:01:17 GMT

Hello Community,

I am trying to understand Palo Alto XDR logs fetched using API(XQL Query).

I am using dataset as xdr_data, want to know what all event_types can come under this dataset.

For ex: EVENT_LOG.

What are the possible values we can get in the field event_type when using dataset=xdr_data.

I want to use event_type in the filter of XQL query, that is why I want to know the possible values.

Any help would appreciate.

Thank you.

Re: Possible Values for event_types

PiyushKohli — Wed, 31 May 2023 10:02:47 GMT

Hi @sushant1601

You may refer to XQL schema reference guide to know the fields of xdr_data dataset along with their description here. Additionally when you create XQl query you get values like Autofill to select for that field, so either you may select from that or when write it will show the available value. As shared in below screenshot for reference:

Hope this helps!

Thanks

Re: Possible Values for event_types

sushant1601 — Fri, 02 Jun 2023 13:32:34 GMT

Thank you for your response. This does help me in understanding the schema, however the value I am using in event_type in XQL query does not match with the possible values provided in schema.

"query": "dataset=xdr_data | filter event_type = EVENT_LOG"

Also, I am using postman to query API, autofill values I don't get.

Thank you.