05-11-2021 02:33 AM
Hey @OrkanAlibayli
In order to query the collected event logs by the WEC capability, you can use the xdr_data dataset (https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-xql-language-reference/get-started-wi...).
Based on the collection profile you configured you can filter on the event IDs you are interested in.
example query:
dataset = xdr_data //use the xdr_data dataset which contains the WEC logs
|filter event_type = EVENT_LOG // filter events to show only event_logs
|fields action_evtlog_message as Message, action_evtlog_event_id as EventID // show the event log message and event_id
if there any specific event you are interested in finding based on the configuration you enabled please do tell
Thanks,
