Cortex XSIAM

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Cortex XSIAM

L0 Member

Hi,

 

Could you please provide guidance on locating the raw log within the Cortex XSIAM tenant?

 

--

Anupama D.

3 REPLIES 3

L4 Transporter

Hi AnupamaD.

 

Can you please clarify, what do you mean by "locating the raw log"?  Are you asking how to query log data that you are bringing in to XSIAM?

Hi @afurze 

I've attached a sample log message view, which is the view that I want to see in XSIAM.

Log View.jpeg

Hi AnupamaD,

 

If you want to query raw logs outside of an incident or alert context, you can use the Query Builder (Incident Response -> Query Builder).  You can pick one of the 'wizard' style query builders, Basic, Identity, Endpoint, Network, or Cloud, which all search using the Cortex Data Model.  If you want to write more complex queries or have more control over filtering and such, you can construct your own queries using XQL, either against a specific dataset, or, more commonly, using the same data model.

  • 1961 Views
  • 3 replies
  • 0 Likes
  • 25 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!