To review and correlate network traffic with Host Firewall events efficiently in Cortex XDR, you should utilize a combination of dedicated datasets and optimized XQL join stages.

The optimal approach involves querying the host_firewall_events dataset for firewall-specific enforcement and joining it with normalized network presets to gain process and connectivity context.

1. Identify the Correct Datasets:

Host Firewall Events: Enforcement actions (Allow/Block) taken by the agent's firewall module are stored in the dedicated host_firewall_events dataset.
Network Traffic: General network activity is best reviewed using the network_story (Network Connections) preset, which contains stitched logs combining events from various sources. Alternatively, raw agent network events reside in the xdr_data dataset.

Sample XQL Correlation Query:

The following query correlates blocked Host Firewall events with network connectivity data to identify which processes were involved in the blocked traffic:

dataset = host_firewall_events 
| filter action = 2 // Filter for Blocked events
| fields _time, agent_hostname, action_local_ip, action_remote_ip, action_remote_port, action_process_image_path, actor_process_instance_id, agent_id
| join (
    preset = network_story 
    | fields agent_hostname, actor_process_instance_id, action_app_id_transitions, action_external_hostname
) as net network.agent_hostname = agent_hostname and network.actor_process_instance_id = actor_process_instance_id
| fields _time, agent_hostname, action_process_image_path, action_local_ip, action_remote_ip, action_remote_port, net.action_app_id_transitions, net.action_external_hostname

topic Re: XQL - Hostfirewall events in Cortex XDR Discussions

XQL - Hostfirewall events

Re: XQL - Hostfirewall events

1. Identify the Correct Datasets:

Sample XQL Correlation Query: