View Child Tenant Data

With Cortex XDR managed security, you can view Cortex XDR child tenant data.
By default, Cortex XDR displays data for your tenant. To display the child tenant data, select the tenant from the drop-down.
mssp-select-tenant.png
Access the following child tenant data:
  • Incidents
    1. Navigate to
      Investigation
      Incidents
      .
    2. Right-click to
      View Incident
      .
      Cortex XDR opens the Incident View.
    3. In the
      Incident View
      page, view the incident details and right-click the event table rows to investigate further.
  • Alerts
    1. Navigate to
      Investigation
      Incidents
      Alerts
      .
    2. In the
      Alerts
      table, right-click and select
      Analyze
      .
    3. In the
      Causality View
      , view the alert details and right-click the event table rows to investigate further.
  • Query Builder
    1. Navigate to
      Investigation
      Query Builder
      .
    2. Run a query based on the child tenant Cortex XDR data.
    3. View the query results.
  • Query Center
    1. Navigate to
      Investigation
      Query Center
      .
      The Query Center displays queries you ran on your tenant and the child tenants.
    2. Apply a filter to the
      Tenant
      filed to view queries according to the specific tenants.

Recommended For You