Cortex Data Lake

Palo Alto Networks Strata Logging Service XSOAR Connector provides cloud-based, centralized log storage and aggregation for your organization on premise, virtual (private cloud and public cloud) firewalls, for Prisma Access, and for cloud-delivered services such as Cortex XDR.

Analytics & SIEM · Strata Logging Service by Palo Alto Networks

Configuration parameters

  • refresh_token — Token
  • reg_id — ID
  • auth_key — Key
  • credentials_auth_key —
  • credentials_refresh_token —
  • credentials_reg_id —
  • isFetch — Fetch incidents
  • first_fetch_timestamp — First fetch time (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
  • fetch_table — Fetch Table
  • firewall_severity — Severity of events to fetch (Firewall)
  • firewall_subtype — Subtype of events to fetch (Firewall)
  • fetch_fields — Fetch Fields
  • filter_query — Fetch Filter
  • incidentType — Incident type
  • limit — Max. number of incidents fetched per query
  • proxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)
  • incidentFetchInterval — Incidents Fetch Interval

Commands (19)

  • cdl-get-critical-threat-logs

    Runs a query on the threat table according to preset queries.

  • cdl-get-social-applications

    Runs a query on traffic table where app_sub_category = "social networking".

  • cdl-query-file-data

    Searches the Cortex firewall.file_data table.

  • cdl-query-gp-logs

    Searches the GlobalProtect VPN log table.

  • cdl-query-logs

    Runs a query on any table or field.

  • cdl-query-threat-logs

    Searches the Cortex panw.threat table, which is the threat logs table for PAN-OS/Panorama.

  • cdl-query-traffic-logs

    Searches the Cortex firewall.traffic table. Traffic logs contain entries for the end of each network session.

  • cdl-query-url-logs

    Searches the URL log table.

  • cdl-reset-authentication-timeout

    Use this command in case your authentication calls fail due to internal call-limit, the command will reset the limit cache.

  • cdl-search-by-file-hash

    Runs a query on the threat table with the query 'SELECT * FROM `firewall.threat` WHERE file_sha_256 = <file_hash>'.

  • sls-get-critical-threat-logs

    Runs a query on the threat table according to preset queries.

  • sls-get-social-applications

    Runs a query on traffic table where app_sub_category = "social networking".

  • sls-query-file-data

    Searches the Cortex firewall.file_data table.

  • sls-query-gp-logs

    Searches the GlobalProtect VPN log table.

  • sls-query-logs

    Runs a query on any table or field.

  • sls-query-threat-logs

    Searches the Cortex panw.threat table, which is the threat logs table for PAN-OS/Panorama.

  • sls-query-traffic-logs

    Searches the Cortex firewall.traffic table. Traffic logs contain entries for the end of each network session.

  • sls-query-url-logs

    Searches the URL log table.

  • sls-search-by-file-hash

    Runs a query on the threat table with the query 'SELECT * FROM `firewall.threat` WHERE file_sha_256 = <file_hash>'.