When running a SIEM, you need to have a huge team of many Analysts Level 1, Level 2, Level 3… Escalations to lateral teams (sometimes to take actions such as isolating endpoints/servers, gathering/deleting suspicious files, etc). It is laborious and time consuming to perform simple actions, like creating an alert.
Read Cortex XDR - How We Distinguish Ourselves From a SIEM Solution to learn more on this topic from our experts!
Palo Alto Networks Contributors:
Luis Escobar, Cortex Customer Success Architect
Maor Hojberg, Technical Marketing Engineer
if you mean that Cortex XDR doesn't have a dataset that holds all the datasets, that is correct. But so far we dont need that because in Cortex XDR, you can query and search with XQL any dataset and a combination of them in a very good response time. Creating a dataset of datasets will screw the searches response and so far there is no point to do so.
On top of that we have Cortex XDR Collectors that can collect data/logs from a miriad of sources ftp, linux system logs, windows, webservers of many flavors (IIS, apache, nginx), Fw, you name it. Once that those logs are uploaded in our Cortex management console in the cloud you can perform XQL queries on them.
Additionally you can save the XQL queries in a public area so you and all your work mates can reuse them without reinventing the wheel.
You can also save the queries as correlation rules and set the timing to launch them...
As a source for XQL query center documentation, please visit the link:
From there you can also jump to other very good XQL documentation sources.
Hope this helped.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!