Administrator group from the XDR console

RamyashreeMada — Mon, 27 Nov 2023 05:12:30 GMT

Hello,

We need to pull out list of member IDs from Administrator group from the XDR console.
Kindly help us in retrievng that data from the XDR console.

Re: Administrator group from the XDR console

nsinghvirk — Thu, 30 Nov 2023 14:45:54 GMT

Hello @RamyashreeMada

Thanks for reaching out on LiveCommunity!

If you have enabled the Cloud Identity Engine then you will be able to access your AD data in XDR console. You can use 'pan_dss_raw' dataset to query data in XQL builder. To filter out administrator group you can filter on 'member_of' field and then display fields as per your requirement. Below is an example query.

dataset= pan_dss_raw
| filter (member_of contains """CN=Group Policy Creator Owners,CN=Users,DC=MiddleEarth,DC=local""")
| fields name, guid , sid

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

topic Re: Administrator group from the XDR console in Cortex XDR Discussions

Administrator group from the XDR console

Re: Administrator group from the XDR console