Cortex XDR XQL query

[Vinothkumar_SBA]

Hi Community,

We have multiple Palo Alto firewalls configured in Cortex XDR. How can we check the number of firewalls currently logging into Cortex XDR? Additionally, how can we verify the names and IP addresses of the configured firewalls using a check method for XQL queries?

[aspatil]

Hello @Vinothkumar_SBA ,

Thank you for writing to live community.

You can directly check the connected firewall using GUI Settings → Configurations → Data Collection → Collection Integrations --> NGFW

Not sure if you can get this information using XQL, but you can use dataset = panw_ngfw_system_raw and see if you are able to find any relevant data.

For more information, please refer to below dataset:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-XQL-Language-Reference/Datasets-and...

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.