Forward the Miter ID field by Syslog in CEF format, is it possible?

[rodrigoduarte]

Hello new friends.

I have a receiver receiving events via Syslog in CEF format, but I can't include the Miter ID field.

Any suggestion ?

[jcandelaria]

Hi Rodrigoduarte,

Are you saying that you cant create this filter? then select the syslog server you set-up?

[rodrigoduarte]

Could you give me a basic procedure to apply this filter via Syslog? I'm not the tool administrator, I work with SIEM.
The Cortex administrator said that it was not possible to forward the Miter ID field and I am 80% sure it is possible.

[etugriceri]

Hi Rodrigoduarte,

Its not possible to configure XDR syslog forwarding fields. Scope of Alerts, syslog server and log type (Alerts, Agent Audit logs, Management Audit logs) are just configurable. 
Below URL is about to XDR log formats that the Cortex Data Lake app can forward logs to external syslog server or email.

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-prevent-admin/logs/cortex-xdr-log-not...

[rodrigoduarte]

In short, via Syslog then it will not be possible to obtain Miter ID information?

[etugriceri]

thats correct. There is no field which is related with MITRE in syslog payload but still you can get that information via Email alert or via API. 

related fields in email = mitre_tactic_ids, mitre_technique_ids, mitre_tactic_id_and_name
for the API =mitre_tactics_ids_and_names, mitre_techniques_ids_and_names

for the api details, you can check below. 

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-api/cortex-xdr-apis/incident-manageme...

[jcandelaria]

Hi Rodrigoduarte

Yes, if you are looking for the mitre id inside the syslog alert itself, its not included as specified by link posted by Etugriceri

Feature request can be requested on this.