topic Missing XQL preset queries in Cortex XDR Discussions

Missing XQL preset queries

L.Abbott442294 — Tue, 16 Apr 2024 19:47:07 GMT

Hello we are trying to follow the threat hunting guide for cve-2024-3400. We are trying to use the query:

```

dataset = panw_ngfw_url_raw
| filter url_domain ~= ".*nhdata.s3-us-west-2.amazonaws.com"
| fields _time, log_source_name, action, app, url_domain, uri, url_category, source_ip, source_port, dest_ip, dest_port, protocol, rule_matched, rule_matched_uuid

```

However we are getting an error stating that the dataset does not exist. I can find on the XQL preset description page that the "panw_ngfw_*_raw " dataset should be available to call.

Any suggestions?

Re: Missing XQL preset queries

jmazzeo — Wed, 17 Apr 2024 18:06:21 GMT

Hi @L.Abbott442294, thanks for reaching us using the Live Community.

Can you check if your are ingesting the URL logs in the NGFW integration?

This doc guides you about how to activate each log type on the NGFW log configuration: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Ingest-Data-from-Next-Generation-Firewall

If it says that the dataset doesn't exist, that means that no events were parsed from the NGFW to create it.

If this post answers your question, please mark it as the solution.