Dataset microsoft_windows_raw: Facing Server Error XDR XQL API Query

sushant1601 — Fri, 26 May 2023 07:05:59 GMT

Hello Everyone,

I am trying to fetch logs using xdr_data dataset and I was able to fetch it successfully.

However, when I tried microsoft_windows_raw, it throws me server error.

As per the document I referred, https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-XQL-Language-Reference/Datasets-and-Presets , I should be able to use microsoft_windows_raw dataset as well.

Please guide me if my understanding is not correct.

Re: Dataset microsoft_windows_raw: Facing Server Error XDR XQL API Query

MarvinC — Mon, 29 May 2023 00:38:13 GMT

Hello @sushant1601 ,

Are you trying to extract Windows Event logs?

If yes, you can try the preset = xdr_event_log where you can view the Windows events.

topic Re: Dataset microsoft_windows_raw: Facing Server Error XDR XQL API Query in General Topics

Dataset microsoft_windows_raw: Facing Server Error XDR XQL API Query

Re: Dataset microsoft_windows_raw: Facing Server Error XDR XQL API Query