Showing results for 
Search instead for 
Did you mean: 

Who rated this post

L1 Bithead

Hey @OrkanAlibayli 


In order to query the collected event logs by the WEC capability, you can use the xdr_data dataset (

Based on the collection profile you configured you can filter on the event IDs you are interested in.

example query:

dataset = xdr_data //use the xdr_data dataset which contains the WEC logs
|filter event_type = EVENT_LOG // filter events to show only event_logs
|fields action_evtlog_message as Message, action_evtlog_event_id as EventID // show the event log message and event_id


if there any specific event you are interested in finding based on the configuration you enabled please do tell



View solution in original post

Who rated this post