topic Re: How do I get network traffic data in XSOAR from the SIEM ingestions? in Cortex XSOAR Discussions

How do I get network traffic data in XSOAR from the SIEM ingestions?

SGupta — Tue, 08 Aug 2023 12:52:59 GMT

We have to Generate a report that presents the network traffic data in XSOAR obtained from our SIEM. We would appreciate the guidance on the calculation process and the essential aspects we should include in the report.

Thank you

Re: How do I get network traffic data in XSOAR from the SIEM ingestions?

MBeauchamp2 — Tue, 08 Aug 2023 14:16:09 GMT

Very opened ended question, without much details.

Depending on what the data us (sessions, opened/closed, blocked, bytes, etc etc) if it's being returned to the context and you then need to operate on it within the context of an Incident, you may need a widget that runs as an automation script to calculate whatever it is you're looking for:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.11/Cortex-XSOAR-Administrator-Guide/Create-a-Custom-Widget-Using-an-Automation-Script

If you need it as a report across a bunch of different Incidents, then the data would need to be in an Incident field.

You'll want to start by referencing the sections on Widgets, Dashboards, and Reports on the Admin Guide:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.11/Cortex-XSOAR-Administrator-Guide/Overview

Re: How do I get network traffic data in XSOAR from the SIEM ingestions?

SGupta — Wed, 09 Aug 2023 10:46:28 GMT

I require the data in bytes, specifically the amount of traffic received from the SIEM into XSOAR.

Re: How do I get network traffic data in XSOAR from the SIEM ingestions?

atullo — Fri, 11 Aug 2023 12:01:53 GMT

@SGupta While XSOAR could be used to create the report, I recommend using something like Netflow to gather this data.