Cortex XDR DNS Collectors

[Vinothkumar_SBA]

Hi community,

I have a query regarding Cortex XDR collectors. When installing collectors on the local DOM servers, what types of logs does the Cortex XDR console retrieve? How can these logs help with the investigation of incidents?

[jmazzeo]

Hi @Vinothkumar_SBA, thanks for reaching us using the Live Community.

The XDR Collectors uses a specific profile where you can configure what kind of events you will retrieve from the endpoint where it is installed.

You can see in this document some examples of profiles to configure, also the DNS profile for a domain controller is there.

Please remember this: Ingesting logs and data requires a Cortex XDR Pro per GB license.

Cortex XDR uses Windows DNS Debug logs to enrich your network logs that are searchable in XQL Search using the Windows DNS Debug Cortex Query Language (XQL) dataset (microsoft_dns_raw) for the raw data and query the normalized stories using the xdr_data dataset with the preset called network_story.

If this post answers your question, please mark it as the solution.