Lookup datasets - Administrator Guide - Cortex XDR - Cortex - Security Operations

Investigate threats and respond to incidents quickly with the rapid import of IP addresses, file hashes, and other data from CSV files. After you import the data, use lookup name-value pairs for joins and filters in threat hunting and general queries.

Import business data as a lookup. For example, import user lists with privileged system access, or terminated employees. Then, use the lookup to create allowlists and blocklists to detect or prevent those users from logging in to the network.

Create allowlists to suppress alerts from a group of users, such as users from authorized IP addresses that perform tasks that would normally trigger the alert. Prevent benign events from becoming alerts.

Enrich event data. Use lookups to enrich your event data with name-value combinations derived from external data sources.

Manual upload from a CSV, TSV, or JSON file to Cortex XDR from the Dataset Management page. For more information, see Import a lookup dataset.

Automatic upload by the Files and Folders Collector.

Query results are saved to a lookup dataset. If saved using the target stage, the Type can be either User or Lookup. For more information, see the target stage in the XQL Language Reference Guide.