Looking for an XDR Query that returns the Detailed Ingestion Dashboard information

jeankervens — Wed, 10 Apr 2024 17:04:28 GMT

Hey guys,

I'm trying to create a health monitoring playbook in XSOAR for my Data ingestion log source in Cortex XDR using the XDR API. Running XDR query using the API works well however what I need is an XQL Query that returns the following information on all log sources :

Vendor, Last Seen date and if possible last day ingested (MB), current day ingested (MB) just like the data ingestion dashboard.

Any Idea how this can be done? using the dataset = xdr_data doesn't seem to be what I need. Is there a dataset that queries only data ingestion log source?

Thank you!

Re: Looking for an XDR Query that returns the Detailed Ingestion Dashboard information

jtalton — Tue, 16 Apr 2024 16:01:35 GMT

Hi Jeankervens,

Please take a look at the LIVEcommunity - Cortex XDR Customer Success Webinar: Monitoring with XQL - LIVEcommunity - 567803 (paloaltonetworks.com) which provides some Data Ingestion XQL queries that you may find useful.

Thank you

topic Re: Looking for an XDR Query that returns the Detailed Ingestion Dashboard information in Cortex XDR Discussions

Looking for an XDR Query that returns the Detailed Ingestion Dashboard information

Re: Looking for an XDR Query that returns the Detailed Ingestion Dashboard information