How to Export Cortex XSIAM Logs for Investigation
Summary
A guide to exporting Cortex XSIAM logs with XQL APIs, including how to retrieve raw third-party log lines, handle large result sets, and upload files to LogTotal for review.
Key points
- Cortex XSIAM uses the Cortex XDR XQL API workflow: start a query, retrieve results, and use a stream for results above 1,000 rows.
- Third-party raw datasets commonly follow the <vendor>_<product>_raw naming pattern; the _raw_log field contains the original log line.
- The example query filters fortinet_fortigate_raw for lines containing "web-03" and selects _time and _raw_log.
- Use XDM queries for normalized fields across sources; use _raw_log when retaining the source’s original format is important.
- Older data may be in cold storage, which requires a separate query approach and uses more quota.
- The guide describes uploading raw lines or JSON rows to LogTotal at logtotal[.]com for review.
Article Details
- Defense Focus
- Export, sanitize, and review Cortex XSIAM logs for investigation while preserving original third-party log lines when needed.
- Detection Methods
- Use XQL to query raw third-party datasets and filter on the _raw_log field.
- Use XDM queries for normalized fields across data sources.
- Use the query-results streaming API when results exceed 1,000 rows.
- Data Sources
- Raw third-party datasets following the <vendor>_<product>_raw naming pattern
- The _raw_log field containing the original ingested log line
- Endpoint telemetry in xdr_data
- Normalized data in the XDM data model
- Rule Types
- XQL queries
- Cortex XSIAM XQL query API calls
- Platforms
- Cortex XSIAM
- LogTotal
- Defensive Actions
- Create an API key with a role that can run XQL queries and note its ID and API URL.
- List datasets in Query Builder to identify the correct dataset name.
- Export _raw_log when original log formatting is required; export parsed fields if _raw_log is empty.
- Use the streaming results API for queries returning more than 1,000 rows.
- Narrow the query time window or check quota when queries encounter quota errors.
- Query cold storage separately for older data, accounting for its additional quota cost.
- Upload exported raw lines or JSON rows to LogTotal for sanitization and review.
Vendors
Products
Cortex XDRCortex XSIAM uses the same XQL query APIs as Cortex XDR: start a query, wait for results, and use a stream for anything over 1,000 rows.Cortex XSIAMCortex XSIAM uses the same XQL query APIs as Cortex XDR: start a query, wait for results, and use a stream for anything over 1,000 rows.LogTotalBelow is how to get data out, sanitize it, and investigate it for free in LogTotal.QRadar SaaSXSIAM is Palo Alto Networks’ SOC platform, and it’s where many former QRadar SaaS customers ended up after the 2024 deal.