Cortex XDR Windows Event Collector

[OrkanAlibayli]

Hello!

I set up Windows Event Collector and data is coming to XDR. But i want to see data which come from Windows Event collector. In which category this data located? How can i search Windows Event collector data in XQL?

THANKS!

[mabutbul · Accepted solution]

Hey @OrkanAlibayli 

In order to query the collected event logs by the WEC capability, you can use the xdr_data dataset (https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-xql-language-reference/get-started-wi...).

Based on the collection profile you configured you can filter on the event IDs you are interested in.

example query:

dataset = xdr_data //use the xdr_data dataset which contains the WEC logs
|filter event_type = EVENT_LOG // filter events to show only event_logs
|fields action_evtlog_message as Message, action_evtlog_event_id as EventID // show the event log message and event_id

if there any specific event you are interested in finding based on the configuration you enabled please do tell

Thanks,