Visibility of Logs and Alerts from External Sources - Administrator Guide - Cortex XDR - Cortex

Abstract

Cortex XDR provides visibility into your external logs. The availability of logs and alerts varies by the data source.

The following table describes the visibility of each vendor and device type, and where you can view information ingested from external sources, depending on the data source.

A indicates support and a dash (—) indicates the feature is not supported.

Network connections

Vendor and Device Type	Raw Data Visibility	Normalized Log Visibility	Cortex XDR Alert Visibility	Vendor Alert Visibility
Amazon S3 (flow logs)	Raw data is searchable in XQL Search.	Option to ingest network flow logs as Cortex XDR network connection stories that are searchable in the Query Builder and in XQL Search.	Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs. Note While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.	—
Amazon S3 (Route 53 logs)	Raw data is searchable in XQL Search.	Option to ingest network Route 53 DNS logs as Cortex XDR network connection stories that are searchable in the Query Builder and in XQL Search.	Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs. Note While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.	—
Azure Event Hub	Raw data is searchable in XQL Search.	—	Cortex XDR can raise Cortex XDR alerts (Correlation Rules only) when relevant from flow logs.	—
Azure Network Watcher (flow logs)	Raw data is searchable in XQL Search.	Option to ingest network flow logs as Cortex XDR network connection stories that are searchable in the Query Builder and in XQL Search.	Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from flow logs. Note While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.	—
Check Point FW1/VPN1	Raw data is searchable in XQL Search. Note Logs with `sessionid = 0` are dropped.	Network stories that include Check Point network connection logs are searchable in the Query Builder and in XQL Search. Note Logs with `sessionid = 0` are dropped.	Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs. Note While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.	Alerts from Check Point firewalls are raised throughout Cortex XDR when relevant.
Corelight Zeek	Raw data is searchable in XQL Search.	Network stories that include Corelight Zeek network connection logs are searchable in the Query Builder and in XQL Search.	Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs. Note While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.	—
Cisco ASA and Cisco AnyConnect VPN	Raw data is searchable in XQL Search.	Network stories that include Cisco network connection logs are searchable in the Query Builder and in XQL Search.	Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs. Note While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.	—
Fortinet Fortigate	Raw data is searchable in XQL Search.	Network stories that include Fortinet network connection logs are searchable in the Query Builder and in XQL Search.	Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs. Note While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.	Alerts from Fortinet firewalls are raised throughout Cortex XDR when relevant.
Google Cloud Platform (flow logs, DNS logs)	Raw data is searchable in XQL Search.	Option to ingest network flow logs as Cortex XDR network connection stories and Google Cloud DNS logs that are searchable in the Query Builder and in XQL Search.	Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs. Note While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.	—
Okta	Raw data is searchable in XQL Search.	—	Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs. Note While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs. IOCs and BIOCs are only raised for these event types: `sso` and `session_start`.	—
Windows DHCP via Elasticsearch Filebeat	Raw data is searchable in XQL Search.	Cortex XDR uses Windows DHCP logs to enrich your network logs with hostnames and MAC addresses that are searchable in XQL Search.	—	—
Zscaler Internet Access (ZIA)	Raw data is searchable in XQL Search.	Network stories that include ZIA network connection and firewall logs are searchable in the Query Builder and in XQL Search.	Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs. Note While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs. Analytics, IOCs and BIOCs are only raised on the Firewall data. The Zscaler Nanolog Streaming Service (NSS) feed for web logs is only used for Correlation Rules and threat hunting.	—
Zscaler Private Access (ZPA)	Raw data is searchable in XQL Search.	Network stories that include ZPA network connection logs are searchable in the Query Builder and in XQL Search.	Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs. Note While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs. The Zscaler Nanolog Streaming Service (NSS) feed for web logs is only used for Correlation Rules and threat hunting.	—

Authentication services/Audit logs

Vendor and Device Type	Raw Data Visibility	Normalized Log Visibility	Cortex XDR Alert Visibility	Vendor Alert Visibility
Amazon S3 (audit logs)	Logs and stories are searchable in XQL Search	Option to stitch audit logs with authentication stories that are searchable in the Query Builder and XQL Search.	Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs. Note While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.	—
Azure Event Hub (audit logs, AKS logs)	Logs and stories are searchable in XQL Search	Option to stitch audit logs with authentication stories that are searchable in the Query Builder and XQL Search.	Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs. Note While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.	—
Google Cloud Platform (audit logs, GKE logs)	Raw data is searchable in XQL Search.	Option to stitch audit logs with authentication stories that are searchable in the Query Builder and XQL Search.	Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs. Note While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.	—
Google Workspace	Raw data is searchable in XQL Search.	Relevant Login, Token, Google drive, SAML, Admin Console, Enterprise Groups, and Rules audit logs normalized into authentication stories. All are searchable in the Query Builder.	For all logs, Cortex XDR can raise Cortex XDR alerts (Analytics and Correlation Rules) when relevant from logs.	—
Microsoft 365 email	Email logs are searchable in XQL Search	Microsoft 365 normalized email stories	For Microsoft 365 email logs, Cortex XDR can also raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from the email logs.	—
Microsoft Office 365Ingest Logs from Microsoft Office 365	Logs and stories (Azure AD authentication and audit logs only) are searchable in XQL Search	Azure AD authentication logs and Azure AD Sign-in logs normalized into authentication stories. Azure AD audit logs normalized to cloud audit logs stories. Exchange Online, SharePoint Online, and General audit logs normalized into stories. All are searchable in the Query Builder.	For all Microsoft Office 365 logs, Cortex XDR can also raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from Office 365 logs. Note While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.	—
Okta	Logs and stories are searchable in XQL Search	Logs stitched with authentication stories are searchable in the Query Builder.	Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules only) when relevant from logs. Note While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs. IOCs and BIOCs are only raised for these event types: `sso` and `session_start`.	—
OneLogin	Raw data is searchable in XQL Search.	All log types are normalized into authentication stories, and are searchable in the Query Builder.	Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs. Note While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.	—
PingFederate	Logs and stories are searchable in XQL Search	Logs stitched with authentication stories are searchable in the Query Builder.	Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs. Note While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.	—
PingOne for Enterprise	Raw data is searchable in XQL Search	Logs stitched with authentication stories are searchable in the Query Builder.	Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs. Note While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.	—

Operation and system logs from cloud providers

Vendor and Device Type	Raw Data Visibility	Normalized Log Visibility	Cortex XDR Alert Visibility	Vendor Alert Visibility
Amazon S3 (generic logs)	Raw data is searchable in XQL Search.	—	Cortex XDR can raise Cortex XDR alerts (Correlation Rules only) when relevant from logs.	—
Amazon CloudWatch (generic logs, EKS logs)	Raw data is searchable in XQL Search.		Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs. Note While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.	—
Azure Event Hub	Raw data is searchable in XQL Search.	—	Cortex XDR can raise Cortex XDR alerts (Correlation Rules only) when relevant from logs.	—
Google Cloud Platform	Raw data is searchable in XQL Search.	—	Cortex XDR can raise Cortex XDR alerts (Correlation Rules only) when relevant from logs.	—
Google Kubernetes Engine	Raw data is searchable in XQL Search.	—	Cortex XDR can raise Cortex XDR alerts (Correlation Rules only) when relevant from logs.	—
Okta	Raw data is searchable in XQL Search.	—	Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs. Note While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.	—
Prisma Cloud (alerts)	Raw data is searchable in XQL Search.	Prisma Cloud alerts are stitched with Cloud Provider logs when relevant.	Cortex XDR can raise Cortex XDR alerts (Correlation Rules only) when relevant from logs.	Alerts from Prisma Cloud are raised throughout Cortex XDR when relevant.
Prisma Cloud Compute (alerts)	Raw data is searchable in XQL Search.	—	Cortex XDR can raise Cortex XDR alerts (Correlation Rules only) when relevant from logs.	Alerts from Prisma Cloud Compute are raised throughout Cortex XDR when relevant.

Endpoint logs

Vendor and Device Type	Raw Data Visibility	Normalized Log Visibility	Cortex XDR Alert Visibility	Vendor Alert Visibility
Windows Event CollectorActivate Windows Event Collector	Windows event logs are available with agent EDR data and are searchable in XQL Search. The normalized Windows event log data is also available in `microsoft_windows_raw` and is searchable in XQL Search.	Windows event logs are stitched with agent EDR data and are searchable in the Query Builder. The Windows event logs are also normalized into the common Cortex Windows event format in `microsoft_windows_raw` and are searchable using the Query Builder.	Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs. Note While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.	—

Vendor and Device Type

Raw Data Visibility

Normalized Log Visibility

Cortex XDR Alert Visibility

Vendor Alert Visibility

Windows Event CollectorActivate Windows Event Collector

Windows event logs are available with agent EDR data and are searchable in XQL Search.

The normalized Windows event log data is also available in microsoft_windows_raw and is searchable in XQL Search.

Windows event logs are stitched with agent EDR data and are searchable in the Query Builder.

The Windows event logs are also normalized into the common Cortex Windows event format in microsoft_windows_raw and are searchable using the Query Builder.

Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs.

Note

While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.

—

Cloud assets

Vendor and Device Type	Raw Data Visibility	Normalized Log Visibility	Cortex XDR Alert Visibility	Vendor Alert Visibility
AWS	—	N/A	N/A	N/A
Google Cloud Platform	—	N/A	N/A	N/A
Microsoft Azure	—	N/A	N/A	N/A

Custom external sources

Vendor and Device Type	Raw Data Visibility	Normalized Log Visibility	Cortex XDR Alert Visibility	Vendor Alert Visibility
Any Vendor Sending CEF, LEEF, CISCO, CORELIGHT, or RAW formatted Syslog	Raw data is searchable in XQL Search.	—	Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs. Note While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.	To enable Cortex XDR to display alerts from other vendors, you must map your alert fields to the Cortex XDR field format (see Ingest External Alerts).
Any vendor CSV files on a shared Windows directory	Raw data is searchable in XQL Search.	—	Cortex XDR can raise Cortex XDR alerts (Correlation Rules only) when relevant from logs.	—
Any vendor logs stored in a database	Raw data is searchable in XQL Search.	—	Cortex XDR can raise Cortex XDR alerts (Correlation Rules only) when relevant from logs.	—
Any vendor logs stored in files on a network share	Raw data is searchable in XQL Search.	—	Cortex XDR can raise Cortex XDR alerts (Correlation Rules only) when relevant from logs.	—
Any vendor logs from a third party source over FTP, FTPS, or SFTP	Raw data is searchable in XQL Search.	—	Cortex XDR can raise Cortex XDR alerts (Correlation Rules only) when relevant from logs.	—
Any vendor sending NetFlow flow records	Raw data is searchable in XQL Search.	NetFlow events are stitched with the Agent’s EDR data and other Network products to a Session Story, and are searchable in the Query Builder and in XQL.	Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs. Note While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.	—
Any vendor sending logs over HTTP	Raw data is searchable in XQL Search.	—	Cortex XDR can raise Cortex XDR alerts (Correlation Rules only) when relevant from logs.	To enable Cortex XDR to display alerts from other vendors, you must map your alert fields to the Cortex XDR field format (see Ingest External Alerts).
Apache Kafka	Raw data is searchable in XQL Search.	—	Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs. Note While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.	—
BeyondTrust Privilege Management Cloud	Raw data is searchable in XQL Search.	—	Cortex XDR can raise Cortex XDR alerts (Correlation Rules only) when relevant from logs.	—
Box	Raw data is searchable in XQL Search.	Selected Box audit event logs are normalized into stories and are searchable in the Query Builder and in XQL.	Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs. Note While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.	—
Dropbox	Raw data is searchable in XQL Search.	Selected Box audit event logs are normalized into stories and are searchable in the Query Builder and in XQL.	Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs. Note While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.	—
Elasticsearch Filebeat	Raw data is searchable in XQL Search.	—	Cortex XDR can raise Cortex XDR alerts (Correlation Rules only) when relevant from logs.	—
Forcepoint DLP	Raw data is searchable in XQL Search.	—	Cortex XDR can raise Cortex XDR alerts (Correlation Rules only) when relevant from logs.	—
IoT Security	Raw data is searchable in XQL Search.	Cortex XDR uses IoT Security information to improve analytics detection and assets management information.	Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs. Note While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.	—
Proofpoint Targeted Attack Protection	Raw data is searchable in XQL Search.	—	Cortex XDRCortex XDR alerts (Correlation Rules only) when relevant from logs.	—
Salesforce.com	Raw data is searchable in XQL Search.	—	Cortex XDR can raise Cortex XDR alerts (Correlation Rules only) when relevant from logs.	—
ServiceNow CMDB	Raw data is searchable in XQL Search.	—	Cortex XDRCortex XDR alerts (Correlation Rules only) when relevant from logs.	—
Strata Logging Service	Raw data is searchable in XQL Search.	Detection events are stitched with other Palo Alto Networks product logs to stories, and are searchable in the Query Builder and in XQL.	Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs. Note While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.	Alerts from NGFW are raised throughout Cortex XDR when relevant.
Workday	Raw data is searchable in XQL Search.	—	Cortex XDRCortex XDR alerts (Correlation Rules only) when relevant from logs.	—
Any vendor sending alerts	—	—	—	Alerts are surfaced throughout Cortex XDR when relevant. To enable Cortex XDR to display your alerts, you must map your alert fields to the Cortex XDR field format (see Ingest External Alerts).

Datasets created from ingesting data

When ingesting data from an external source, Cortex XDR creates a dataset that you can query using Cortex Query Language (XQL). Datasets created in this way use the following naming convention.

            <vendor_name>_<product_name>_raw

For example: cisco_asa_raw

The datatypes used for the fields in an imported dataset are automatically assigned based on the input content. Fields can have a datatype of string, int, float, array, time, or boolean. All other fields are ingested as a JSON object.

For CEF type files, when extension values are quoted, the CEF parser automatically removes the quotes from the values. In addition, files containing invalid UTF-8 are parsed under XQL mapping field _invalid_utf8.

Visibility of Logs and Alerts from External Sources - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR Pro Administrator Guide

Network connections

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note

Note

Authentication services/Audit logs

Note

Note

Note

Note

Note

Note

Note

Note

Operation and system logs from cloud providers

Note

Note

Endpoint logs

Note

Cloud assets

Custom external sources

Note

Note

Note

Note

Note

Note

Note

Datasets created from ingesting data