Cortex XSIAM

[AnupamaD]

Hi,

Could you please provide guidance on locating the raw log within the Cortex XSIAM tenant?

--

Anupama D.

[afurze]

Hi AnupamaD.

Can you please clarify, what do you mean by "locating the raw log"?  Are you asking how to query log data that you are bringing in to XSIAM?

[AnupamaD]

Hi @afurze 

I've attached a sample log message view, which is the view that I want to see in XSIAM.

[afurze]

Hi AnupamaD,

If you want to query raw logs outside of an incident or alert context, you can use the Query Builder (Incident Response -> Query Builder).  You can pick one of the 'wizard' style query builders, Basic, Identity, Endpoint, Network, or Cloud, which all search using the Cortex Data Model.  If you want to write more complex queries or have more control over filtering and such, you can construct your own queries using XQL, either against a specific dataset, or, more commonly, using the same data model.