Administrator group from the XDR console

[RamyashreeMada]

Hello,

We need to pull out list of member IDs from Administrator group from the XDR console.
Kindly help us in retrievng that data from the XDR console.

[nsinghvirk]

Hello @RamyashreeMada 

Thanks for reaching out on LiveCommunity!

If you have enabled the Cloud Identity Engine then you will be able to access your AD data in XDR console. You can use 'pan_dss_raw' dataset to query data in XQL builder. To filter out administrator group you can filter on 'member_of' field and then display fields as per your requirement. Below is an example query.

dataset= pan_dss_raw
| filter (member_of contains """CN=Group Policy Creator Owners,CN=Users,DC=MiddleEarth,DC=local""")
| fields name, guid , sid

Please click Accept as Solution to acknowledge that the answer to your question has been provided.