Exporting events from Cortex XDR

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Exporting events from Cortex XDR

Hello,

I have been doing some searching on if I can get XDR endpoint logs like processes and etc into a third party SIEM.

Based on the XDR API there is no way to export events (You can technically run XQL queries using the API but this would get logged on XDR)

It also looks like you cannot actually forward XDR data from the data lake to a syslog server and then to your SIEM.

So if I am not wrong there is no way to export endpoint events from XDR to a third party SIEM.

Can I get a confirmation on this and that I am not missing anything?

Thanks.

2 accepted solutions

Accepted Solutions

L5 Sessionator

Hi @AvesterFahimipour ,

 

Thank you for writing to live community!

 

Cortex XDR agent based logs are aggregated and stored in XDR data layer itself. Infact with that being said, we are anyways deprecating the concept of different data lakes for third party source data and all of the logs will be streamed by XDR.

 

Coming back to the use case of attempting forwarding of raw events from Cortex XDR, inorder to achieve this action, customers need to have Cortex XDR Event forwarding license. This license comes in two parts:

  1. EP Forwarding: For Endpoint data collected by Cortex XDR agents
  2. GB forwarding: For third party data.

The Event Forwarding license allows you to forward data into available GCP buckets where your data is stored for 14 days. The data is compressed and saved as a line-delimited JSON gzip file.

 

For more details you can review here: Manage Event Forwarding

Once, you have the license, the event forwarding option is listed under Data Management on the Configuration page of Cortex XDR.  

Screenshot 2023-10-27 at 9.35.20 PM.png

 

Hope this helps! Please mark the response as "Accept as Solution" if it answers your query

View solution in original post

Hi @AvesterFahimipour ,

 

Please check your license page if you have already procured it. The license window should refer to an entitlement as shown in the screenshot below for Endpoint agent event forwarding.

 

If not, you might want to reach out to your sales engineer or the local accounts team for procurement.

Screenshot 2023-10-30 at 7.53.07 PM.png

View solution in original post

3 REPLIES 3

L5 Sessionator

Hi @AvesterFahimipour ,

 

Thank you for writing to live community!

 

Cortex XDR agent based logs are aggregated and stored in XDR data layer itself. Infact with that being said, we are anyways deprecating the concept of different data lakes for third party source data and all of the logs will be streamed by XDR.

 

Coming back to the use case of attempting forwarding of raw events from Cortex XDR, inorder to achieve this action, customers need to have Cortex XDR Event forwarding license. This license comes in two parts:

  1. EP Forwarding: For Endpoint data collected by Cortex XDR agents
  2. GB forwarding: For third party data.

The Event Forwarding license allows you to forward data into available GCP buckets where your data is stored for 14 days. The data is compressed and saved as a line-delimited JSON gzip file.

 

For more details you can review here: Manage Event Forwarding

Once, you have the license, the event forwarding option is listed under Data Management on the Configuration page of Cortex XDR.  

Screenshot 2023-10-27 at 9.35.20 PM.png

 

Hope this helps! Please mark the response as "Accept as Solution" if it answers your query

One more question:
How do we get the event forwarding license, I cannot find it anywhere.

Hi @AvesterFahimipour ,

 

Please check your license page if you have already procured it. The license window should refer to an entitlement as shown in the screenshot below for Endpoint agent event forwarding.

 

If not, you might want to reach out to your sales engineer or the local accounts team for procurement.

Screenshot 2023-10-30 at 7.53.07 PM.png

  • 2 accepted solutions
  • 3063 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!