topic Re: how to vie cloud identy engine logs on cortex in Cortex XDR Discussions

how to vie cloud identy engine logs on cortex

RajeshPremSingh — Fri, 02 Jun 2023 04:10:47 GMT

We successfully implemented the cloud identity engine on-prem and in the cloud, and we enabled the engine on the cortex as well, but we don't know how to view the logs. Could you please tell us where to look for the login logs on the cortex?

Re: how to vie cloud identy engine logs on cortex

nsinghvirk — Wed, 07 Jun 2023 14:58:53 GMT

Hello @RajeshPremSingh

You can use pan_dss_raw dataset to view your Cloud Identity Engine logs.

Re: how to vie cloud identy engine logs on cortex

afurze — Wed, 14 Jun 2023 17:14:54 GMT

Hi RajeshPremSing,

The Cloud Identity Agent is designed just to bring in object data from an identity provider (whether that be Azure AD, on-prem ActiveDirectory, Okta, etc.). It ingests information about users, groups, computers, etc. that are then available for use within Cortex XDR and other Palo Alto Networks products, it does not collect any event data like Windows Event logs.

Collection of data about login events and other AD related activities, comes from either the XDR agent being installed on your Domain Controllers, or through collection of Windows Event logs via the XDR Collector or Windows Event Collection on a Broker VM. This data is then stitched in to the XDR dataset and searchable via a query like the one below.

preset = xdr_event_log | filter action_evtlog_event_id = 4624