topic Cortex XSIAM in Cortex XSIAM Discussions

Cortex XSIAM

AnupamaD — Thu, 24 Aug 2023 19:00:42 GMT

Hi,

Could you please provide guidance on locating the raw log within the Cortex XSIAM tenant?

Anupama D.

Re: Cortex XSIAM

afurze — Fri, 25 Aug 2023 19:17:02 GMT

Hi AnupamaD.

Can you please clarify, what do you mean by "locating the raw log"? Are you asking how to query log data that you are bringing in to XSIAM?

Re: Cortex XSIAM

AnupamaD — Mon, 28 Aug 2023 05:21:14 GMT

Hi @afurze

I've attached a sample log message view, which is the view that I want to see in XSIAM.

Re: Cortex XSIAM

afurze — Mon, 28 Aug 2023 13:58:06 GMT

Hi AnupamaD,

If you want to query raw logs outside of an incident or alert context, you can use the Query Builder (Incident Response -> Query Builder). You can pick one of the 'wizard' style query builders, Basic, Identity, Endpoint, Network, or Cloud, which all search using the Cortex Data Model. If you want to write more complex queries or have more control over filtering and such, you can construct your own queries using XQL, either against a specific dataset, or, more commonly, using the same data model.