Who rated this post

Hey @OrkanAlibayli 

In order to query the collected event logs by the WEC capability, you can use the xdr_data dataset (https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-xql-language-reference/get-started-wi...).

Based on the collection profile you configured you can filter on the event IDs you are interested in.

example query:

dataset = xdr_data //use the xdr_data dataset which contains the WEC logs
|filter event_type = EVENT_LOG // filter events to show only event_logs
|fields action_evtlog_message as Message, action_evtlog_event_id as EventID // show the event log message and event_id

if there any specific event you are interested in finding based on the configuration you enabled please do tell

Thanks,