Why is the Palo Alto Cortex XDR Pro incident event...

Getting Data In

Good afternoon,

I have a Cortex XDR input configured in my Palo Alto Networks add-on.

I want to deploy some use cases my company has developed and I need "vendor_action" and "file_hash".

Looking inside the events, neither of these fields are present in the JSON data indexed from the add-on.

Do anyone knows why this happens? I'm using 7.0.2 version.

Thanks a lot for the help in advance!

Get Updates on the Splunk Community!

In today’s data-heavy environment, organizations are caught in a data distribution dilemma. As data volumes ...

Streamlining Data Management: Introducing a unified experience in Splunk Managing data at scale shouldn’t feel ...

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Why is the Palo Alto Cortex XDR Pro incident events missing some fields?