This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About sushant1601
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About sushant1601
06-09-2023
8Posts
0Likes
0Solutions
Jun 09, 2023Last Visited
User
Activity
User
Profile
Latest posts by sushant1601
| Subject | Views | Posted |
|---|---|---|
| 30 | 06-09-2023 09:50 AM | |
| 69 | 06-09-2023 06:31 AM | |
| 71 | 06-08-2023 09:59 AM | |
| 81 | 06-08-2023 08:56 AM | |
| 83 | 06-02-2023 06:32 AM | |
| 212 | 06-02-2023 06:25 AM | |
| 200 | 05-26-2023 12:05 AM | |
| 234 | 05-24-2023 08:01 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 2 Likes |
User Badges
Community Statistics
| Member Since | 05-24-2023 07:51 AM |
| Date Last Visited | 06-09-2023 01:22 PM |
| Posts | 8 |
06-09-2023
09:50 AM
Thank you @nsinghvirk for the quick response. Really appreciate it.
Followup to your response, currently we query based on creation time to pull logs and to keep a pointer of the log fetched.. If local_insert_ts is the time when XDR agent ingests an alert, can we use this field in the API query to pull the logs?
Thank you again for your response.
... View more
06-09-2023
06:31 AM
Hello Everyone,
We are pulling alerts from the XDR API using below endpoint:
/public_api/v1/alerts/get_alerts
We query based on creation time which is shown as detection_timestamp in the log.
I am looking for clarity on below points:
1. what is local_insert_ts field? What is the significance of this field? How it is different from creation time?
2. Without local_insert_ts, is the log available in API to fetch?
3. Is it possible that the local_insert_ts value may get changed for the same event? If it get changed, in what condition it happens?
Thank you.
Cortex XDR
... View more
06-08-2023
09:59 AM
Thank you so much @zarnous
... View more
06-08-2023
08:56 AM
Hi @zarnous
Thank you so much for explaining in details. Really appreciate your response.
Just last small query. In the second point you mentioned the value of the field should not be changed unless the hostname itself changes. So, is agent hostname is same as of hostname of the endpoint?
Clearing this because we are working to ingest the logs and we do not have the device with us. So, I can not verify this on the device itself.
Again, thank you for the response!
... View more
06-02-2023
06:32 AM
Thank you for your response. This does help me in understanding the schema, however the value I am using in event_type in XQL query does not match with the possible values provided in schema.
"query" : "dataset=xdr_data | filter event_type = EVENT_LOG"
Also, I am using postman to query API, autofill values I don't get.
Thank you.
... View more
06-02-2023
06:25 AM
Hello Everyone,
For one of the client, we need to fetch logs from XDR API using XQL. Currently, the ask is for windows event logs only, but later they want IIS logs as well.
Any help in below queries would be appreciated:
1. There are two queries by which I fetched logs successfully. One is using:
dataset= xdr_data | filter event_type = EVENT_LOG
Second query I tried is using preset:
preset = xdr_event_log
By both of these queries I'm getting event logs. I would like to know if both the queries are correct and I'm not missing on anything.
If both the queries are correct, which would be efficient one?
2. Second query is regarding schema. I have gone through XDR_DATA schema. I just want to clarify if agent_hostname field's value changes each endpoint or is it same? This may sound stupid but basically we want to know which endpoint logged this event and if we can be sure that each agent on each endpoint has separate hostname.
3. In future we need to fetch IIS logs as well. I could not find any document or help regarding this. Which dataset or preset is used for IIS logs? Does XQL query even work for IIS or it logs to CDL?
Any help would be great.
Thanks in advance.
Cortex XDR
... View more
05-26-2023
12:05 AM
Hello Everyone,
I am trying to fetch logs using xdr_data dataset and I was able to fetch it successfully.
However, when I tried microsoft_windows_raw, it throws me server error.
As per the document I referred, https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-XQL-Language-Reference/Datasets-and-Presets , I should be able to use microsoft_windows_raw dataset as well.
Please guide me if my understanding is not correct.
... View more
05-24-2023
08:01 AM
Hello Community,
I am trying to understand Palo Alto XDR logs fetched using API(XQL Query).
I am using dataset as xdr_data, want to know what all event_types can come under this dataset.
For ex: EVENT_LOG.
What are the possible values we can get in the field event_type when using dataset=xdr_data.
I want to use event_type in the filter of XQL query, that is why I want to know the possible values.
Any help would appreciate.
Thank you.
... View more
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks