Cortex XDR and splunk logging

[Vadim_Lisserman]

Has anyone noticed that splunk logging format has changed for xdr logs, including the sourcetype?

[susekar]

Hello @Vadim_Lisserman ,

Greetings for the day.

As of now, we have not received any cases or reported issues related to this.

However, this behavior could be associated with the transition to Cortex XDR versions 4.x and 5.0. Such upgrades may impact how Splunk ingests and categorizes data, potentially affecting sourcetypes and the availability of specific fields.

Troubleshooting Recommendations:

If you notice format changes affecting your Splunk environment:

1. Check the "Legacy Log Format" Setting:
   Ensure this setting is enabled if your Splunk parsers were built for older XDR versions.
2. Verify CEF vs. LEEF Headers:
   Confirm that the log format configured in XDR Syslog matches the input configuration on your Splunk Heavy Forwarder or Universal Forwarder.
3. Use API for Detailed Data:
   For fields that may be truncated or missing in standard CEF syslog (such as detailed descriptions or file hashes), it is recommended to use the Cortex XDR REST API (for example, /public_api/v1/incidents/get_incident_extra_data/) to retrieve more comprehensive data into Splunk.
   
   

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar