Exporting events from Cortex XDR

[AvesterFahimipour]

Hello,

I have been doing some searching on if I can get XDR endpoint logs like processes and etc into a third party SIEM.

Based on the XDR API there is no way to export events (You can technically run XQL queries using the API but this would get logged on XDR)

It also looks like you cannot actually forward XDR data from the data lake to a syslog server and then to your SIEM.

So if I am not wrong there is no way to export endpoint events from XDR to a third party SIEM.

Can I get a confirmation on this and that I am not missing anything?

Thanks.

[neelrohit · Accepted solution]

Hi @AvesterFahimipour ,

Thank you for writing to live community!

Cortex XDR agent based logs are aggregated and stored in XDR data layer itself. Infact with that being said, we are anyways deprecating the concept of different data lakes for third party source data and all of the logs will be streamed by XDR.

Coming back to the use case of attempting forwarding of raw events from Cortex XDR, inorder to achieve this action, customers need to have Cortex XDR Event forwarding license. This license comes in two parts:

1. EP Forwarding: For Endpoint data collected by Cortex XDR agents
2. GB forwarding: For third party data.

The Event Forwarding license allows you to forward data into available GCP buckets where your data is stored for 14 days. The data is compressed and saved as a line-delimited JSON gzip file.

For more details you can review here: Manage Event Forwarding

Once, you have the license, the event forwarding option is listed under Data Management on the Configuration page of Cortex XDR.  

Hope this helps! Please mark the response as "Accept as Solution" if it answers your query

[AvesterFahimipour]

One more question:
How do we get the event forwarding license, I cannot find it anywhere.

[neelrohit · Accepted solution]

Hi @AvesterFahimipour ,

Please check your license page if you have already procured it. The license window should refer to an entitlement as shown in the screenshot below for Endpoint agent event forwarding.

If not, you might want to reach out to your sales engineer or the local accounts team for procurement.