How to Export Cortex XDR Logs With XQL APIs
Summary
The guide explains how to export Cortex XDR endpoint telemetry through XQL APIs, retrieve large result sets, and upload data to LogTotal for sanitization and review, with setup, quota, licensing and troubleshooting notes.
Key points
- Start an XQL query, then retrieve its results; up to 1,000 results are returned inline, while larger results require the stream endpoint.
- Authenticate with the API key in the Authorization header and its ID in x-xdr-auth-id.
- The XQL APIs require a Cortex XDR Pro license, use the XQL quota, and allow up to four parallel API queries.
- Endpoint telemetry is available in the xdr_data dataset; the guide recommends building queries in Query Builder first.
- The guide directs users to upload exported files to LogTotal (logtotal[.]com) for sanitization and review.
- Troubleshooting covers authentication errors, licensing and quota issues, streamed results, and query syntax.
Article Details
- Defense Focus
- Export Cortex XDR telemetry through XQL APIs for sanitization and investigation in LogTotal.
- Detection Methods
- Query the xdr_data dataset and filter endpoint telemetry by hostname, then review event and process-command-line fields.
- Use the Query Builder to test XQL syntax before running an API query.
- Data Sources
- Cortex XDR endpoint telemetry in the xdr_data dataset
- Network and identity data in deployments where those data are collected
- Third-party logs ingested into Cortex XDR, in their own datasets
- Rule Types
- XQL queries
- Platforms
- Cortex XDR
- LogTotal
- Defensive Actions
- Create a Cortex XDR API key with a role that can run XQL queries; keep the key and key ID in their respective authentication headers.
- Retrieve results in JSON, and use the results stream API when the response provides a stream ID or exceeds 1,000 results.
- Account for the Cortex XDR Pro license requirement, XQL quota, and limit of four parallel API queries.
- Sanitize exported logs before reviewing them in LogTotal.