For one of the client, we need to fetch logs from XDR API using XQL. Currently, the ask is for windows event logs only, but later they want IIS logs as well.
Any help in below queries would be appreciated:
1. There are two queries by which I fetched logs successfully. One is using:
dataset= xdr_data | filter event_type = EVENT_LOG
Second query I tried is using preset:
preset = xdr_event_log
By both of these queries I'm getting event logs. I would like to know if both the queries are correct and I'm not missing on anything.
If both the queries are correct, which would be efficient one?
2. Second query is regarding schema. I have gone through XDR_DATA schema. I just want to clarify if agent_hostname field's value changes each endpoint or is it same? This may sound stupid but basically we want to know which endpoint logged this event and if we can be sure that each agent on each endpoint has separate hostname.
3. In future we need to fetch IIS logs as well. I could not find any document or help regarding this. Which dataset or preset is used for IIS logs? Does XQL query even work for IIS or it logs to CDL?
Any help would be great.
Thanks in advance.
... View more