Looking for an XDR Query that returns the Detailed Ingestion Dashboard information

[jeankervens]

Hey guys,

I'm trying to create a health monitoring playbook in XSOAR for my Data ingestion log source in Cortex XDR using the XDR API. Running XDR query using the API works well however what I need is an XQL Query that returns the following information on all log sources :

Vendor, Last Seen date and if possible last day ingested (MB), current day ingested (MB) just like the data ingestion dashboard.

Any Idea how this can be done? using the dataset = xdr_data doesn't seem to be what I need. Is there a dataset that queries only data ingestion log source?

Thank you!

[jtalton]

Hi Jeankervens,

Please take a look at the LIVEcommunity - Cortex XDR Customer Success Webinar: Monitoring with XQL - LIVEcommunity - 567803 (p... which provides some Data Ingestion XQL queries that you may find useful. 

Thank you