cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Who rated this post

L4 Transporter

Hello @PhyoWaiSoe 

 

Thanks for reaching out on LiveCommunity!

XDR collector already contains the Filebeat package, you do not need to install it separately. To check incoming data please ensure that XDR collector is in connected state. Then you can use XQL query language to query data to following datasets.

  • For Filebeat, the app automatically creates an Cortex Query Language (XQL) dataset of event logs using the vendor name and the product name specified in the configuration file section of the Filebeat profile. The dataset name follows the format <vendor>_<product>_raw. If not specified, Cortex XDR automatically creates a new default dataset in the format <module>_<module>_raw or <input>_<input>_raw. For example, if you are using the NGINX module, the dataset is called nginx_nginx_raw.

  • For Winlogbeat, the app automatically creates an XQL dataset of event logs using the vendor name and the product name specified in the configuration file section of the Winlogbeat profile. The dataset name follows the format <vendor>_<product>_raw. If not specified, Cortex XDR automatically creates a new default dataset, microsoft_windows_raw, for event log collection.

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

View solution in original post

Who rated this post