Possible Values for event_types

[sushant1601]

Hello Community, 

I am trying to understand Palo Alto XDR logs fetched using API(XQL Query). 

I am using dataset as xdr_data, want to know what all event_types can come under this dataset. 

For ex: EVENT_LOG. 

What are the possible values we can get in the field event_type when using dataset=xdr_data.

I want to use event_type in the filter of XQL query, that is why I want to know the possible values. 

Any help would appreciate. 

Thank you. 

[PiyushKohli]

Hi @sushant1601 

You may refer to XQL schema reference guide to know the fields of xdr_data dataset along with their description here. Additionally when you create XQl query you get values like Autofill to select for that field, so either you may select from that or when write it will show the available value. As shared in below screenshot for reference:

Hope this helps!

Thanks

[sushant1601]

Thank you for your response. This does help me in understanding the schema, however the value I am using in event_type in XQL query does not match with the possible values provided in schema. 

"query": "dataset=xdr_data | filter event_type = EVENT_LOG"

Also, I am using postman to query API, autofill values I don't get. 

Thank you.