Create a correlation between xdr agent and palo alto url filtering

[FabioFerreira]

Hi,

I need to get the correlation between url that are being access and found through url filtering in PA FW and xdr agent that shows me which machine are accessing this url.

In Cortex XDR I can see the the log from PA Firewall, source ip it is our internal DNS and destination the malicious URL, and I need to know who is doing this query, which user and client IP.

[jtalton]

Hi Fabio, 

If you have Configured Your Network Devices to send PAN NGFW logs to the Cortex Data Lake, you can create an XQL query to search for the correlation. 

For example, the below query uses the Network Story preset, which groups xdr_data fields that are useful for analyzing specific areas of network and endpoint activity; this query displays any connections done by the specified browser(s) processes for an IP configured in the PANW NGFW logs:

preset = network_story  // Using XDR network story preset
| filter action_remote_ip = "ipaddress" and lowercase(actor_process_image_name) in ("chrome.exe", "msedge.exe","opera.exe", "firefox.exe", "iexplore.exe") // "ipaddress" enter the ipaddress associated with the event. Enter the browser process name
| fields agent_hostname, action_local_ip, action_remote_ip, action_remote_port, dst_action_external_hostname, actor_process_image_path, actor_process_image_sha256, actor_process_command_line // selecting the relevant fields
| dedup agent_hostname, action_local_ip, action_remote_ip, action_remote_port, dst_action_external_hostname, actor_process_image_path, actor_process_image_sha256, actor_process_command_line  by asc _time // dedupping to only show the first time it happened
| sort desc _time  // sorting in desc order

The network story preset also entails:

network_story	dns_query_name	string
network_story	dns_query_type	string
network_story	dns_resolutions	json
network_story	dns_reply_code	string

Thank you