I'm trying to extract endpoint data from Cortex XDR, but I don't want to see just alerts in Splunk—I need all the endpoint data collected by XDR to be replicated in Splunk. Neither Palo Alto nor Splunk support has been able to assist with this. I can't be the first person to ask about it since this is a fundamental requirement—unless it's simply not possible and everyone else already knows that except me. There should be one way calling the APIs through HEC in Splunk, I need to write a script for it, any one tried this approach or any other ?  ... View more