Cortex XDR XQL query

Vinothkumar_SBA — Thu, 28 Dec 2023 06:11:48 GMT

Hi Community,

We have multiple Palo Alto firewalls configured in Cortex XDR. How can we check the number of firewalls currently logging into Cortex XDR? Additionally, how can we verify the names and IP addresses of the configured firewalls using a check method for XQL queries?

Re: Cortex XDR XQL query

aspatil — Thu, 28 Dec 2023 16:38:08 GMT

Hello @Vinothkumar_SBA ,

Thank you for writing to live community.

You can directly check the connected firewall using GUI Settings → Configurations → Data Collection → Collection Integrations --> NGFW

Not sure if you can get this information using XQL, but you can use dataset = panw_ngfw_system_raw and see if you are able to find any relevant data.

For more information, please refer to below dataset:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-XQL-Language-Reference/Datasets-and-Presets

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

topic Re: Cortex XDR XQL query in Cortex XDR Discussions

Cortex XDR XQL query

Re: Cortex XDR XQL query