cyber.hendryadrian.com
Detection & Defense · socprime.com

How to Export Raw Logs from Major SIEM Platforms for External Analysis

· Original article ↗

Summary

A SOC Prime guide gives API and CLI export routes for major SIEMs, recommends narrow time windows and raw events, and explains permission, time-zone and retention limits. It also promotes LogTotal for file-based analysis.

Key points

  • The guide recommends exporting raw events rather than parsed JSON when possible, using an API or CLI for large exports.
  • It lists export options for Splunk, IBM QRadar, OpenSearch, Elasticsearch, CrowdStrike Falcon, Microsoft Sentinel, Microsoft Defender XDR and Google SecOps.
  • It advises narrowing searches by host, source, event type and time window, and checking event counts before exporting.
  • It highlights common export pitfalls: browser limits, API token permissions, drifting relative time windows and wrapped event data.
  • SIEM searches cannot recover original Windows EVTX files, data past retention or fields discarded during ingestion.
  • The article says LogTotal accepts syslog-style text, JSON and EVTX; text and JSON uploads are sanitized before analysis.

Article Details

Defense Focus
Export SIEM events for independent detection analysis while preserving raw event data and accounting for export limitations.
Detection Methods
  • Run detection logic against exported files in LogTotal for a second opinion or to identify detections missing from the SIEM.
  • Use a narrow host, source, event-type, and time-window scope, and count matching events before exporting.
  • Export events rather than aggregated reports or summaries.
Data Sources
  • Raw SIEM events and original payloads
  • Parsed JSON documents and event fields
  • CrowdStrike Falcon telemetry
  • Google SecOps UDM JSON and original raw logs
  • Syslog-style text, JSON, and Windows EVTX files
Rule Types
  • Splunk search
  • Microsoft Defender XDR Advanced Hunting query
  • Elasticsearch ES|QL
  • Google SecOps UDM search
Platforms
  • Splunk
  • IBM QRadar
  • OpenSearch
  • Elasticsearch
  • CrowdStrike Falcon
  • Microsoft Sentinel
  • Microsoft Defender XDR
  • Google SecOps
  • LogTotal
Defensive Actions
  • Prefer raw events over parsed JSON when available, and verify that raw lines or needed fields were retained at ingestion.
  • For exports of more than a few thousand events, use the platform API or CLI rather than the browser.
  • Check API-token permissions and relevant roles, security profiles, or Graph scopes when export counts differ from the UI.
  • Use absolute time windows in UTC or with an explicit offset to keep rerun searches consistent.
  • Flatten wrapped API responses to one event per line before uploading.
  • Retrieve EVTX files from the host; SIEM exports provide rendered text or JSON rather than original EVTX files.
  • Check retention and archive status before expecting aged-out data to be available in a normal search.
  • Sanitize text and JSON uploads before analysis in LogTotal.

Vendors

CrowdStrikeCrowdStrike Falcon Advanced Event Search export, or Falcon Data Replicator Falcon telemetry as JSON [CrowdStrike]ElasticElasticsearch elasticsearch-py helpers.scan, PIT with search_after, or ES|QL (up to 10,000 rows) JSON documents; raw line in event.original if preserved [Elastic]GoogleGoogle SecOps UDM search API, or Data Export API to Cloud Storage UDM JSON, or original raw logs [Google SecOps]IBMIBM QRadar Ariel REST API with UTF8(payload) Original payloads [QRadar]MicrosoftMicrosoft Sentinel az monitor log-analytics query One JSON object per row [Sentinel]SOC PrimeWe’re adding guides for the rest of the 65+ platforms SOC Prime supports.SplunkSplunk CLI splunk search -output rawdata, or REST search/v2/jobs/export with output_mode=raw Original raw lines [Splunk]

Products

CrowdStrike FalconCrowdStrike Falcon Advanced Event Search export, or Falcon Data Replicator Falcon telemetry as JSON [CrowdStrike]ElasticsearchElasticsearch elasticsearch-py helpers.scan, PIT with search_after, or ES|QL (up to 10,000 rows) JSON documents; raw line in event.original if preserved [Elastic]Google SecOpsGoogle SecOps UDM search API, or Data Export API to Cloud Storage UDM JSON, or original raw logs [Google SecOps]IBM QRadarIBM QRadar Ariel REST API with UTF8(payload) Original payloads [QRadar]LogTotalPrime Core has 1M detection rules across these platforms, mapped to 676 MITRE ATT&CK techniques, and LogTotal runs them against a file for free.Microsoft Defender XDRMicrosoft Defender XDR Microsoft Graph runHuntingQuery Advanced hunting rows as JSON [Defender XDR]Microsoft SentinelMicrosoft Sentinel az monitor log-analytics query One JSON object per row [Sentinel]OpenSearchOpenSearch opensearch-py helpers.scan, or _search with PIT JSON documents; raw line if kept in message [OpenSearch]Prime CorePrime Core has 1M detection rules across these platforms, mapped to 676 MITRE ATT&CK techniques, and LogTotal runs them against a file for free.SplunkSplunk CLI splunk search -output rawdata, or REST search/v2/jobs/export with output_mode=raw Original raw lines [Splunk]

Related Articles