Does Cortex XDR capture full URL visits?

AbFahad — Thu, 25 Apr 2024 05:55:51 GMT

Hello community,

Do you know if Cortex XDR has the capability to capture full URL visits please? Can you please share any documentations saying so if yes.

Thanks.

Re: Does Cortex XDR capture full URL visits?

jmazzeo — Thu, 25 Apr 2024 20:09:59 GMT

Hi @AbFahad, thanks for reaching us using the Live Community.

Using the preset "network_story" in a XQL query, you can see the "dst_action_external_hostname" field with URL accessed by the endpoint. It doesn't contain the full URL request, to have this you need to integrate NGFW Url logs.

preset = network_story | filter agent_hostname = "YOUR_HOSTNAME"

If this post answers your question, please mark it as the solution.

topic Does Cortex XDR capture full URL visits? in Cortex XDR Discussions

Does Cortex XDR capture full URL visits?

Re: Does Cortex XDR capture full URL visits?