Missing XQL preset queries

[L.Abbott442294]

Hello we are trying to follow the threat hunting guide for cve-2024-3400. We are trying to use the query:

```

dataset = panw_ngfw_url_raw
| filter url_domain ~= ".*nhdata.s3-us-west-2.amazonaws.com"
| fields _time, log_source_name, action, app, url_domain, uri, url_category, source_ip, source_port, dest_ip, dest_port, protocol, rule_matched, rule_matched_uuid

```

However we are getting an error stating that the dataset does not exist. I can find on the XQL preset description page that the "panw_ngfw_*_raw " dataset should be available to call.

Any suggestions? 

[jmazzeo · Accepted solution]

Hi @L.Abbott442294, thanks for reaching us using the Live Community.

Can you check if your are ingesting the URL logs in the NGFW integration? 

This doc guides you about how to activate each log type on the NGFW log configuration: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Ingest-Data...

If it says that the dataset doesn't exist, that means that no events were parsed from the NGFW to create it.

If this post answers your question, please mark it as the solution.