How do I get network traffic data in XSOAR from the SIEM ingestions?

[SGupta]

We have to Generate a report that presents the network traffic data in XSOAR obtained from our SIEM. We would appreciate the guidance on the calculation process and the essential aspects we should include in the report.

Thank you
Cortex XSOAR

[MBeauchamp2]

Very opened ended question, without much details.

Depending on what the data us (sessions, opened/closed, blocked, bytes, etc etc) if it's being returned to the context and you then need to operate on it within the context of an Incident, you may need a widget that runs as an automation script to calculate whatever it is you're looking for:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.11/Cortex-XSOAR-Administrator-Guide/Create...

If you need it as a report across a bunch of different Incidents, then the data would need to be in an Incident field. 

You'll want to start by referencing the sections on Widgets, Dashboards, and Reports on the Admin Guide:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.11/Cortex-XSOAR-Administrator-Guide/Overvi...

[SGupta]

I require the data in bytes, specifically the amount of traffic received from the SIEM into XSOAR.

[atullo]

@SGupta While XSOAR could be used to create the report, I recommend using something like Netflow to gather this data.