XQL queries on management audit logs

bjchappell — Tue, 12 Dec 2023 23:26:55 GMT

Is it possible to XQL query XDR management audit logs? I'd like to create a dashboard to track console events like logins, endpoint isolations, malware scans, etc.

Re: XQL queries on management audit logs

aspatil — Wed, 13 Dec 2023 10:20:32 GMT

Hello @bjchappell ,

Thank you for writing to live community.

You can use dataset = management_auditing and create a query as per your requirement.

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

topic Re: XQL queries on management audit logs in Cortex XDR Discussions

XQL queries on management audit logs

Re: XQL queries on management audit logs