I am thinking of a way to bring in xdr_data dataset logs which we see in xdr query builder to splunk.
As of now i am ingesting the alert and incident data from cortex xdr into splunk.
Can anyone suggest, how i can achieve this?
Hello Community,
Was wondering whether someone could assit me with an issue.
So at the moment i cannot make any search via the "Query Builder".
When i move to query center and create a custom query i can only return results when i search "dataset = pan_
When running this XQL query if I add event_sub_type to the filter it fails to run
I can run the query without any filters, and then add the event_sub_type column without issues
dataset = xdr_data
| filter event_type = ENUM.FILE and (event_sub_type =
Hello,
Is there any option available to upgrade agent from local agent console? (Eg: If local IT team can upgrade agent from endpoint directly)
Thanks
Hello dear community,
Has anyone build a xql query for this case:
https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/
Should this help?
https://live.paloaltonet
...
