topic Re: Is there a documentation available for Cortex XDR related to event_type and event_sub_type? in Cortex XDR Discussions

Is there a documentation available for Cortex XDR related to event_type and event_sub_type?

josh_arenas — Mon, 22 Jan 2024 10:47:33 GMT

Hi,

Is there available documentation for ENUM numeric values in event_type and event_sub_type in XDR? Trying it in a query and it asks for the numeric value (Example: event_type = 1; PROCESS).

Thanks!

Re: Is there a documentation available for Cortex XDR related to event_type and event_sub_type?

jmazzeo — Mon, 22 Jan 2024 12:40:21 GMT

Hi @josh_arenas, thanks for reaching us using the Live Community.

We have this document available with the full description of the xdr_data Dataset fields:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XQL-Schema-Reference-Guide/XDR_DATA-Fields

Let me know if this works for you, and mark this post as the solution.

Thanks!

Re: Is there a documentation available for Cortex XDR related to event_type and event_sub_type?

A.Elzedy — Mon, 23 Jun 2025 20:11:06 GMT

Hi @josh_arenas,

Here you go

https://github.com/AbdallaElzedy/Cortex-XSIAM/blob/main/xdr_datamodel_docs.md