Find Incidents/Alerts triggered based on 3rd Party Integrations

[Bojan-Totic]

Hey!

We've recently added a 3rd party integration "Office 365" to Cortex XDR's Log Collection.

I was just wondering if there was any obvious way to find alerts/incidents that triggered based on Office 365.

Kind Regards,

Bojan

[jmazzeo · Accepted solution]

Hi @Bojan-Totic, thanks for reaching us using the Live Community.

You can filter the Alerts table by Alert Source, selecting there the source of the alert, in your case Office 365.

You can also run a XQL Query with the same filter, and use that information for a widget, dashboard or report.

dataset = alerts 
| filter alert_source = ENUM.PAN_NGFW // Example with NGFW, select your O365 alert source

If this post answers your question, please mark it as the solution.

[Bojan-Totic]

Thank you for the reply!

That XQL is really useful  🙂 I hadn’t realized we could look up alerts there now.

I don’t see Office 365 listed as an alert source yet, though I can see that some alerts have trickled in through SaaS Log Collection.

Some additional context:

• Our team recently added third-party log sources, including Office 365.
• I was notified that a detection involving O365 was triggered, but I can’t find it anywhere in the alert/incident source.

Now I’m wondering if they meant that an alert was perhaps just enriched with O365 log data, rather than an analytic rule actually triggering under Office 365 as its own alert source..

It looks like we're still within the 14-day activation period, which makes sense. 🙂

So when something does trigger.. I should definitely see it as its own Alert Source, right?

..Or is it odd that Office 365 isn’t listed as an Alert Source yet, even though nothing has triggered yet? 0.o

Bojan