IP Adress Not Show When Use XDR Collector

G.Anshar — Wed, 16 Jul 2025 08:51:34 GMT

Hello everyone, I have a question. I'm using the XDR Collector to ingest log data from both Linux and Windows servers, but some server IP addresses are not showing up. Is there any solution for this?

Re: IP Adress Not Show When Use XDR Collector

eluis — Wed, 16 Jul 2025 13:11:32 GMT

Hi G.Anshar,

There might be 2 reasons that I can think of fast:

IP address was not stored on log file. Then xdr collector, collects log file without IP
Even the log is produced with the IP addresses, at parse time, that specific field is lost or not properly populated in the correct IP address field. Please
review that the regexes are working and properly designed

You might check if the raw files produced in the servers are storing IP addresses

The following doc helps on parsing rules
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-3.x-Documentation/Parsing-Rules

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis

topic Re: IP Adress Not Show When Use XDR Collector in Cortex XDR Discussions

IP Adress Not Show When Use XDR Collector

Re: IP Adress Not Show When Use XDR Collector