topic Re: Forward the Miter ID field by Syslog in CEF format, is it possible? in Cortex XDR Discussions

Forward the Miter ID field by Syslog in CEF format, is it possible?

rodrigoduarte — Sat, 26 Jun 2021 04:05:51 GMT

Hello new friends.

I have a receiver receiving events via Syslog in CEF format, but I can't include the Miter ID field.

Any suggestion ?

Re: Forward the Miter ID field by Syslog in CEF format, is it possible?

jcandelaria — Sun, 27 Jun 2021 03:34:32 GMT

Hi Rodrigoduarte,

Are you saying that you cant create this filter? then select the syslog server you set-up?

Re: Forward the Miter ID field by Syslog in CEF format, is it possible?

rodrigoduarte — Sun, 27 Jun 2021 18:59:12 GMT

Could you give me a basic procedure to apply this filter via Syslog? I'm not the tool administrator, I work with SIEM.
The Cortex administrator said that it was not possible to forward the Miter ID field and I am 80% sure it is possible.

Re: Forward the Miter ID field by Syslog in CEF format, is it possible?

etugriceri — Mon, 28 Jun 2021 14:02:52 GMT

Hi Rodrigoduarte,

Its not possible to configure XDR syslog forwarding fields. Scope of Alerts, syslog server and log type (Alerts, Agent Audit logs, Management Audit logs) are just configurable.
Below URL is about to XDR log formats that the Cortex Data Lake app can forward logs to external syslog server or email.

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-prevent-admin/logs/cortex-xdr-log-notification-formats/agent-logs-format-syslog-export-logging-service

Re: Forward the Miter ID field by Syslog in CEF format, is it possible?

rodrigoduarte — Mon, 28 Jun 2021 14:08:13 GMT

In short, via Syslog then it will not be possible to obtain Miter ID information?

Re: Forward the Miter ID field by Syslog in CEF format, is it possible?

etugriceri — Mon, 28 Jun 2021 15:20:29 GMT

thats correct. There is no field which is related with MITRE in syslog payload but still you can get that information via Email alert or via API.

related fields in email = mitre_tactic_ids, mitre_technique_ids, mitre_tactic_id_and_name
for the API =mitre_tactics_ids_and_names, mitre_techniques_ids_and_names

for the api details, you can check below.

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-api/cortex-xdr-apis/incident-management/get-extra-incident-data.html

Re: Forward the Miter ID field by Syslog in CEF format, is it possible?

jcandelaria — Mon, 28 Jun 2021 21:25:32 GMT

Hi Rodrigoduarte

Yes, if you are looking for the mitre id inside the syslog alert itself, its not included as specified by link posted by Etugriceri

Feature request can be requested on this.