https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/no-recepcion-de-eventos-en-datacet/m-p/998534#M7587 <P>Hi&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/407320617">@H.PovedaMartinez</a>, thanks for reaching us using the Live Community.</P> <P>&nbsp;</P> <P>I have this example in my lab for Okta SSO, but you can modify it to work with your dataset. This is a <A href="https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/Create-a-correlation-rule" target="_self">Correlation Rule</A>:</P> <P>&nbsp;</P> <LI-CODE lang="markup">dataset = xdr_data | bin _time span = 1h timeshift = 946684800 | comp count() by _time | join type = left conflict_strategy = left (dataset = metrics_source | filter _vendor = "Okta" and _product = "Sso" | bin _time span = 1h timeshift = 946684800) as metrics metrics._time = _time | filter total_event_count = null | alter description = "No data ingested within a 1h timespan for Okta" | fields _time, description</LI-CODE> <P>&nbsp;</P> <P>&nbsp;</P> <P>If this post answers your question, please mark it as the solution.</P> Mon, 16 Dec 2024 18:32:55 GMT jmazzeo 2024-12-16T18:32:55Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/no-recepcion-de-eventos-en-datacet/m-p/998091#M7576 <PRE id="tw-target-text" class="tw-data-text tw-text-large tw-ta" dir="ltr" data-placeholder="Traducción" data-ved="2ahUKEwiTnqaL0qKKAxVzTTABHSP9J4IQ3ewLegQICRAT" aria-label="Texto traducido: Good morning Question, is it possible to create a rule to detect when an XDR datacet is not ingesting events?"><SPAN class="Y2IQFc">Good morning Question, is it possible to create a rule to detect when an XDR datacet is not ingesting events?</SPAN></PRE> Thu, 12 Dec 2024 16:23:25 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/no-recepcion-de-eventos-en-datacet/m-p/998091#M7576 H.PovedaMartinez 2024-12-12T16:23:25Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/no-recepcion-de-eventos-en-datacet/m-p/998534#M7587 <P>Hi&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/407320617">@H.PovedaMartinez</a>, thanks for reaching us using the Live Community.</P> <P>&nbsp;</P> <P>I have this example in my lab for Okta SSO, but you can modify it to work with your dataset. This is a <A href="https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/Create-a-correlation-rule" target="_self">Correlation Rule</A>:</P> <P>&nbsp;</P> <LI-CODE lang="markup">dataset = xdr_data | bin _time span = 1h timeshift = 946684800 | comp count() by _time | join type = left conflict_strategy = left (dataset = metrics_source | filter _vendor = "Okta" and _product = "Sso" | bin _time span = 1h timeshift = 946684800) as metrics metrics._time = _time | filter total_event_count = null | alter description = "No data ingested within a 1h timespan for Okta" | fields _time, description</LI-CODE> <P>&nbsp;</P> <P>&nbsp;</P> <P>If this post answers your question, please mark it as the solution.</P> Mon, 16 Dec 2024 18:32:55 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/no-recepcion-de-eventos-en-datacet/m-p/998534#M7587 jmazzeo 2024-12-16T18:32:55Z