Data Ingest per Source for Palo Alto Firewalls in Cortex XDR

[BH6678]

I do not think this is in the correct Board, but I could not find a Cortex XDR channel.. First time posting so I am sure I missed it. 

I have Cortex XDR and we are trying to see what firewall is sending the largest amount of data by GB Ingest. We are using the collection integrations, NGFW, Panorama Managed. We have 8 firewall pairs that are sending logs to Cortex XDR. We need to see how much in GB each firewall is sending into Cortex. I am sure I am missing something. I can see how many logs, but I would like to see how much in ingest data each is using per day. 

Cortex XDR NGFW 

Thanks!!

[aspatil]

Hello @BH6678 ,

Please refer the query to find the data ingestion from the metric sources. However, the catch here is XDR doesn't provide granular visibility over each firewall ingestion as the required data is not available in data source. As of now this can be achieved by XSIAM. 

dataset = metrics_source
| fields _vendor , _product , total_size_bytes , total_size_rate
| comp sum(total_size_bytes ) as ingestion by _product
| alter Ingestion_by_GB = divide(round(multiply(divide(ingestion , pow(2,30)),10000)),10000) //rounding out to 4 decimal places and convert to MB
| fields _product ,Ingestion_by_GB
| limit 20
| sort desc Ingestion_by_GB
| view graph type = column subtype = grouped layout = horizontal show_callouts = `true` xaxis = _product yaxis = Ingestion_by_GB seriescolor("Ingestion_by_GB","#d2510e") headcolor = "#171616" gridcolor = "#38def6" font = "Arial Black"

You can either reach out to Accounts Team or have FR open to include the device id in metrics_source dataset.

If you feel this has answered your query, please let us know by clicking on Like and "mark this as a Solution".

[PA_nts]

stumbled upon this query here.. thanks helps me alot!

if i were to want to do the graph based on an hourly ingestion rate over a say 24 hour period.. how can i achieve this?

still learning xql so not my strongpoint atm.

running XSIAM as a POC atm