Cortex XDR DNS Collectors

Vinothkumar_SBA — Sat, 06 Jul 2024 09:27:50 GMT

Hi community,

I have a query regarding Cortex XDR collectors. When installing collectors on the local DOM servers, what types of logs does the Cortex XDR console retrieve? How can these logs help with the investigation of incidents?

Re: Cortex XDR DNS Collectors

jmazzeo — Thu, 11 Jul 2024 13:02:05 GMT

Hi @Vinothkumar_SBA, thanks for reaching us using the Live Community.

The XDR Collectors uses a specific profile where you can configure what kind of events you will retrieve from the endpoint where it is installed.

You can see in this document some examples of profiles to configure, also the DNS profile for a domain controller is there.

Please remember this: Ingesting logs and data requires a Cortex XDR Pro per GB license.

Cortex XDR uses Windows DNS Debug logs to enrich your network logs that are searchable in XQL Search using the Windows DNS Debug Cortex Query Language (XQL) dataset (microsoft_dns_raw) for the raw data and query the normalized stories using the xdr_data dataset with the preset called network_story.

If this post answers your question, please mark it as the solution.

topic Cortex XDR DNS Collectors in Cortex XDR Discussions

Cortex XDR DNS Collectors

Re: Cortex XDR DNS Collectors