Is there a documentation available for Cortex XDR related to event_type and event_sub_type?

[josh_arenas]

Hi, 

Is there available documentation for ENUM numeric values in event_type and event_sub_type in XDR? Trying it in a query and it asks for the numeric value (Example: event_type = 1; PROCESS). 

Thanks!

[jmazzeo]

Hi @josh_arenas, thanks for reaching us using the Live Community.

We have this document available with the full description of the xdr_data Dataset fields:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XQL-Schema-Reference-Guide/XDR_DATA-Fields

Let me know if this works for you, and mark this post as the solution.

Thanks!