Exporting alert related data

[MithunKT]

Hi All,

Is there a way to export all the alert data which appears below Causality chain like network connections, registry changes, etc ?

I don't see any download or export icon on the right-hand side of the pane. 

Do we have any other way to export these data?

Thanks!!

Cortex XDR 

Please note you are posting a public message where community members and experts can provide assistance. Sharing private information such as serial numbers or company information is not recommended.

[creddy]

Hi @MithunKT You would be able to retrieve alert data by selecting an existing alert only.

To retrieve the alert data follow the documentation here: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-prevent-admin/investigation-and-respo...
See section Retrieve Additional Alert Details
In Step 2 - follow the Retrieve alert data section
Once in new tab(pivot to view Additional data) right click, then Download Files

[bbarmanroy]

Hi @MithunKT what is the use case you're trying to achieve by exporting the data? Is the end goal to ingest into a SIEM?

[MithunKT]

Hi @bbarmanroy it was for analysis and Investigation purposes. We got an incident from Analytics alert source stating internal scanning was observed, on checking the alert data we found multiple failed network connections from a single host towards multiple internal Destinations.

We just wanted to pass on this data (List of destinations, protocols) everything to the network team but exporting option was not available.

So how do we export the data in these scenarios?  We can't give access to the XDR console to our network team but they should be given alert data in csv or tsv format.

Thanks!!

[bbarmanroy · Accepted solution]

You can run a XQL query to retrieve the information and export the data to pass to your n/w Ops team.

You can also leverage the Network Connections in Query Builder to identify connections.

The results can be downloaded in TSV format and shared across other teams.