Manage external datasets - Manage, view, edit, and query external federated search datasets. - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Documentation
Product
Cortex XSIAM
Creation date
2024-03-06
Last date published
2025-12-29
Category
Administrator Guide
Abstract

Manage, view, edit, and query external federated search datasets.

Manage external datasets created for federates searches in Settings → Configurations → Data Management → Dataset management → External Datasets.

On this page you can do the following:

  • Add an external dataset: Click Add External Dataset.

  • Check the connection status: The connection status is automatically checked once a week. To manually check the connection status, hover to the right on the dataset row and click Check connection.

  • View: Hover to the right on the dataset row and click the eye icon.

  • Edit: You can change the description, the schema, and the Time field.

  • Delete the dataset: Hover to the right on the dataset row and click Delete dataset.

    This action deletes the dataset connection in Cortex XSIAM. The dataset in your external storage isn't affected.

  • Run a query using the dataset: Hover to the right on the dataset row and click the triangle. This opens the Query Builder page, with the dataset already defined.