Does Cortex XDR capture full URL visits?

[AbFahad]

Hello community,

Do you know if Cortex XDR has the capability to capture full URL visits please? Can you please share any documentations saying so if yes.

Thanks.

[jmazzeo · Accepted solution]

Hi @AbFahad, thanks for reaching us using the Live Community.

Using the preset "network_story" in a XQL query, you can see the "dst_action_external_hostname" field with URL accessed by the endpoint. It doesn't contain the full URL request, to have this you need to integrate NGFW Url logs.

preset = network_story 
| filter agent_hostname = "YOUR_HOSTNAME"

If this post answers your question, please mark it as the solution.