Getting Data In
×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question

Why is the Palo Alto Cortex XDR Pro incident events missing some fields?

alcolea90
New Member
‎02-09-2022 09:35 AM

Good afternoon,

I have a Cortex XDR input configured in my Palo Alto Networks add-on.

I want to deploy some use cases my company has developed and I need "vendor_action" and "file_hash".

Looking inside the events, neither of these fields are present in the JSON data indexed from the add-on.

Do anyone knows why this happens? I'm using 7.0.2 version.

Thanks a lot for the help in advance!

Labels (3)
0 Karma
Reply
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...