Set up an HTTP Log Collector to Receive Logs
You can set up Cortex XDR to receive logs from third-party
sources, and automatically parse and process these logs.
Ingesting
logs and data requires a
Cortex
XDR
Pro per TB license.In addition to logs from supported vendors,
you can set up a custom HTTP log collector to receive logs in Raw,
JSON, CEF, or LEEF format.
After .
You can then use XQL Search queries to view logs and create new Correlation
rules.
Cortex
XDR
begins receiving logs from the third-party
source, Cortex
XDR
automatically parses
the logs and creates a dataset with the name <vendor>
_<product>
_rawTo set up an HTTP log collector to receive logs from
an external source.
- Create an HTTP Log collector inCortexXDR.
- Select.Settings (
)
ConfigurationsCustom Collections - In theHTTPconfiguration, clickAdd Instance.
- Specify a descriptiveNamefor your HTTP log collection configuration.
- Select the data objectCompression, either gzip or uncompressed.
- Select theLog FormatasRaw,JSON,CEF, orLEEF.CortexXDRsupports logs in single line format or multiline format. For aJSONformat, multiline logs are collected automatically when theLog Formatis configured asJSON. When configuring aRawformat, you must also define theMultiline Parsing Regexas explained below.-TheVendorandProductdefaults toAuto-Detectwhen theLog Formatis set toCEForLEEF.-For aLog Formatset toCEForLEEF,CortexXDRreads events row by row to look for theVendorandProductconfigured in the logs. When the values are populated in the event log row,CortexXDRuses these values even if you specified a value in theVendorandProductfields in the HTTP collector settings. Yet, when the values are blank in the event log row,CortexXDRuses theVendorandProductthat you specified in the HTTP collector settings. If you did not specify aVendororProductin the HTTP collector settings, and the values are blank in the event log row, the values for both fields are set tounknown.
- Specify theVendorandProductfor the type of logs you are ingesting.The vendor and product are used to define the name of your XQL dataset (). If you do not define a vendor or product,<vendor>_<product>_rawCortexXDRexamines the log header to identify the type and uses that to define the vendor and product in the dataset. For example, if the type is Acme and you opt to letCortexXDRdetermine the values, the dataset name would beacme_acme_raw.
- (Optional) Specify theMultiline Parsing Regexfor logs with multilines.This option is only displayed when theLog Formatis set toRaw, so you can set the regular expression that identifies when the multiline event starts in logs with multilines. It is assumed that when a new event begins, the previous one has ended.
- Save & Generate Token.Click the copy icon next to the key and record it somewhere safe. You will need to provide this key when you configure your HTTP POST request. If you forget to record the key and close the window you will need to generate a new key and repeat this process.ClickDonewhen finished.
- Send data to yourCortexXDRHTTP log collector.
- Send an HTTP POST request to the URL for your HTTP Log Collector.For a sample curl or python request, clickView Example.
- Substitute the values specific to your configuration.
- url—You can copy the URL for your HTTP log collector from theCustom Collectorspage. For example:https://api-{tenant external URL}/logs/v1/event.
- api_key—API key you previously recorded for your HTTP log collector.
- Content-Type—Depending on the data object format you selected during setup, this will beapplication/jsonfor JSON format ortext/plainfor Text format.
- Body—The body contains the records you want to send toCortexXDR. Separate records with a\n(new line) delimiter. The request body can contain up to 10Mib records although 1 Mib is recommended. In the case of a curl command, the records are contained in the-d ‘parameter.<records>’
- Monitor your HTTP Log Collection integration.You can return to thepage to monitor the status of your HTTP Log Collection configuration. For each instance,Settings (
)
ConfigurationsCustom CollectorsCortexXDRdisplays the number of logs received in the last hour, day, and week. You can also use the Data Ingestion Dashboard to view general statistics about your data ingestion configurations.
Recommended For You
Recommended Videos
Recommended videos not found.