Good afternoon,
I have a Cortex XDR input configured in my Palo Alto Networks add-on.
I want to deploy some use cases my company has developed and I need "vendor_action" and "file_hash".
Looking inside the events, neither of these fields are present in the JSON data indexed from the add-on.
Do anyone knows why this happens? I'm using 7.0.2 version.
Thanks a lot for the help in advance!
