Cortex XDR Incident integration splunk tool

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Cortex XDR Incident integration splunk tool

L3 Networker

We are currently integrating the Cortex XDR incident logs with the Splunk tool. Currently, the incident logs are visible in the Splunk tool, but certain essential fields required for conducting an XDR log investigation are not available in the existing logs. These necessary fields include File Name, File Path, File Hash, Command Line, Grand Parent Name, Parent Name, Grand Parent Command Line, Parent Command Line, IOC value, and a few others.

 

 

1 accepted solution

Accepted Solutions

L4 Transporter

Hi @Vinothkumar_SBA 

 

Thank you for writing to live community!

Would suggest and recommend before posting details/query could you remove/redact the specifics/info related to your org. Regarding this request could you confirm about ingestion of Incidents to Splunk are you doing using api or you are referring to Notifications configured for Log Alert Type as Alerts using syslog server. 

 

Above logs is related to "XDR Analytics" therefore for this sort of Alert Sources here are the default fields if selected all would be received. The table in the URL shared earlier describes each field. Hope this will help and clarify for the fields to be received per Analytics Log format or different Alert Sources Log format here.
 
In case of analytics alerts you may receive file details like full_path and md5 however for other fields like commandline, actor_process(Parent_Process), action_process(Child_Process) it may vary and could be present based on Alert Sources. 
 

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

View solution in original post

2 REPLIES 2

L4 Transporter

Hi @Vinothkumar_SBA 

 

Thank you for writing to live community!

Would suggest and recommend before posting details/query could you remove/redact the specifics/info related to your org. Regarding this request could you confirm about ingestion of Incidents to Splunk are you doing using api or you are referring to Notifications configured for Log Alert Type as Alerts using syslog server. 

 

Above logs is related to "XDR Analytics" therefore for this sort of Alert Sources here are the default fields if selected all would be received. The table in the URL shared earlier describes each field. Hope this will help and clarify for the fields to be received per Analytics Log format or different Alert Sources Log format here.
 
In case of analytics alerts you may receive file details like full_path and md5 however for other fields like commandline, actor_process(Parent_Process), action_process(Child_Process) it may vary and could be present based on Alert Sources. 
 

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

Hi@PiyushKohli,

We have configure the API integration.

  • 1 accepted solution
  • 1189 Views
  • 2 replies
  • 0 Likes
  • 78 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!