XQL query for all datasets

P.Kanagasingham — Tue, 18 Feb 2025 20:37:58 GMT

What's the fastest way to get a list of all data types by product and vendor across all data sets? I am looking for a way to query internal logs of XDR to get a list of all types of logs that are getting ingested into the XDR instead of using wildcard for the dataset keyword (E.g: dataset = * ). It is a resource intensive search.

Re: XQL query for all datasets

aspatil — Wed, 19 Feb 2025 05:37:54 GMT

Hello @P.Kanagasingham ,

Thanks for reaching out on LiveCommunity!

To get a list of all data types by product and vendor across all data sets you can check below article and refer to Available datasets section.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/Datasets-and-presets

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

topic XQL query for all datasets in Cortex XDR Discussions

XQL query for all datasets

Re: XQL query for all datasets