12-22-2023 07:45 AM
Hello @PhyoWaiSoe
Thanks for reaching out on LiveCommunity!
XDR collector already contains the Filebeat package, you do not need to install it separately. To check incoming data please ensure that XDR collector is in connected state. Then you can use XQL query language to query data to following datasets.
For Filebeat, the app automatically creates an Cortex Query Language (XQL) dataset of event logs using the vendor name and the product name specified in the configuration file section of the Filebeat profile. The dataset name follows the format <vendor>_<product>_raw. If not specified, Cortex XDR automatically creates a new default dataset in the format <module>_<module>_raw or <input>_<input>_raw. For example, if you are using the NGINX module, the dataset is called nginx_nginx_raw.
For Winlogbeat, the app automatically creates an XQL dataset of event logs using the vendor name and the product name specified in the configuration file section of the Winlogbeat profile. The dataset name follows the format <vendor>_<product>_raw. If not specified, Cortex XDR automatically creates a new default dataset, microsoft_windows_raw, for event log collection.
Please click Accept as Solution to acknowledge that the answer to your question has been provided.
