how to vie cloud identy engine logs on cortex

[RajeshPremSingh]

We successfully implemented the cloud identity engine on-prem and in the cloud, and we enabled the engine on the cortex as well, but we don't know how to view the logs. Could you please tell us where to look for the login logs on the cortex?

[nsinghvirk]

Hello @RajeshPremSingh 

You can use pan_dss_raw dataset to view your Cloud Identity Engine logs.

[afurze]

Hi RajeshPremSing,

The Cloud Identity Agent is designed just to bring in object data from an identity provider (whether that be Azure AD, on-prem ActiveDirectory, Okta, etc.).  It ingests information about users, groups, computers, etc. that are then available for use within Cortex XDR and other Palo Alto Networks products, it does not collect any event data like Windows Event logs.

Collection of data about login events and other AD related activities, comes from either the XDR agent being installed on your Domain Controllers, or through collection of Windows Event logs via the XDR Collector or Windows Event Collection on a Broker VM.  This data is then stitched in to the XDR dataset and searchable via a query like the one below.

preset = xdr_event_log
| filter action_evtlog_event_id = 4624