Cortex XDR Incident integration splunk tool

[Vinothkumar_SBA]

We are currently integrating the Cortex XDR incident logs with the Splunk tool. Currently, the incident logs are visible in the Splunk tool, but certain essential fields required for conducting an XDR log investigation are not available in the existing logs. These necessary fields include File Name, File Path, File Hash, Command Line, Grand Parent Name, Parent Name, Grand Parent Command Line, Parent Command Line, IOC value, and a few others.

[PiyushKohli · Accepted solution]

Hi @Vinothkumar_SBA 

Thank you for writing to live community!

Would suggest and recommend before posting details/query could you remove/redact the specifics/info related to your org. Regarding this request could you confirm about ingestion of Incidents to Splunk are you doing using api or you are referring to Notifications configured for Log Alert Type as Alerts using syslog server. 

Above logs is related to "XDR Analytics" therefore for this sort of Alert Sources here are the default fields if selected all would be received. The table in the URL shared earlier describes each field. Hope this will help and clarify for the fields to be received per Analytics Log format or different Alert Sources Log format here.

In case of analytics alerts you may receive file details like full_path and md5 however for other fields like commandline, actor_process(Parent_Process), action_process(Child_Process) it may vary and could be present based on Alert Sources. 

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

[Vinothkumar_SBA]

Hi@PiyushKohli,

We have configure the API integration.