https://live.paloaltonetworks.com/t5/cortex-xsiam-discussions/trendmicro-apex-one-alert-mapping-into-xsiam/m-p/1262529#M469 <P>Hi All</P> <P>Has anyone done this to date and willing to share their Correlation XQL logic used to map alerts from Apex One into XSIAM?</P> <P>I have done this for a few others already like Crowdstrike, MS Graph API etc</P> <P>but having issues with time to navigate through all the raw log data to determine the required fields to validate and alert on what is required. hence the cheat post on here for someone to push me in the right direction <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>&nbsp;</P> <P>thanks in adv</P> <P>&nbsp;</P> Fri, 21 Aug 2026 15:25:51 GMT PA_nts 2026-08-21T15:25:51Z https://live.paloaltonetworks.com/t5/cortex-xsiam-discussions/trendmicro-apex-one-alert-mapping-into-xsiam/m-p/1262529#M469 <P>Hi All</P> <P>Has anyone done this to date and willing to share their Correlation XQL logic used to map alerts from Apex One into XSIAM?</P> <P>I have done this for a few others already like Crowdstrike, MS Graph API etc</P> <P>but having issues with time to navigate through all the raw log data to determine the required fields to validate and alert on what is required. hence the cheat post on here for someone to push me in the right direction <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>&nbsp;</P> <P>thanks in adv</P> <P>&nbsp;</P> Fri, 21 Aug 2026 15:25:51 GMT https://live.paloaltonetworks.com/t5/cortex-xsiam-discussions/trendmicro-apex-one-alert-mapping-into-xsiam/m-p/1262529#M469 PA_nts 2026-08-21T15:25:51Z