Follow Every SIEM can hand its data back in one of two shapes: the original raw events, or its own parsed JSON. For analysis outside the SIEM, raw events are almost always the better choice. Export them for a narrow time window through the API or CLI, not the browser. The table below shows the best route for each major platform, with a link to the full guide.
Why bother taking data out of a SIEM at all? For a second opinion, to share with an IR partner who has no access, or to run detection logic your SIEM doesn’t have. Prime Core has 1M detection rules across these platforms, mapped to 676 MITRE ATT&CK techniques, and LogTotal runs them against a file for free.
Platform by platform
| Platform | Best export route | What you get | Full guide |
|---|---|---|---|
| Splunk | CLI splunk search -output rawdata, or REST search/v2/jobs/export with output_mode=raw | Original raw lines | [Splunk] |
| IBM QRadar | Ariel REST API with UTF8(payload) | Original payloads | [QRadar] |
| OpenSearch | opensearch-py helpers.scan, or _search with PIT | JSON documents; raw line if kept in message | [OpenSearch] |
| Elasticsearch | elasticsearch-py helpers.scan, PIT with search_after, or ES|QL (up to 10,000 rows) | JSON documents; raw line in event.original if preserved | [Elastic] |
| CrowdStrike Falcon | Advanced Event Search export, or Falcon Data Replicator | Falcon telemetry as JSON | [CrowdStrike] |
| Microsoft Sentinel | az monitor log-analytics query | One JSON object per row | [Sentinel] |
| Microsoft Defender XDR | Microsoft Graph runHuntingQuery | Advanced hunting rows as JSON | [Defender XDR] |
| Google SecOps | UDM search API, or Data Export API to Cloud Storage | UDM JSON, or original raw logs | [Google SecOps] |
Six rules that apply everywhere
- Export events, not summaries. Anything that ends in stats, summarize, table or an aggregation is a report, not logs.
- Narrow first. Host, source, event type, time window. Count before you pull; most platforms show the number in the UI.
- Use the API or CLI for anything over a few thousand events. Browser exports time out, rerun searches, or silently cap the row count.
- Mind the permission boundary. API tokens often see less than your UI session: QRadar security profiles, Splunk roles, Graph scopes. When numbers don’t match, check the token first.
- Pin the time zone. Use absolute windows in UTC or with an explicit offset. Relative windows (“last 24 hours”) drift if a search reruns.
- Unwrap the envelope. Many APIs wrap each event: a JSON string inside CloudTrailEvent, a Records array, a result key, a CloudWatch message. Flatten to one event per line with jq before you upload.
What a SIEM can’t give you back
- Original binaries. No SIEM returns Windows EVTX files; you get rendered text or JSON. For EVTX, go to the host.
- Data past retention. Once it’s aged out, or moved to an archive tier that needs a restore, a normal search won’t find it.
- Fields dropped at ingest. If the pipeline discarded the raw line or a field, it’s gone. Check before you promise an analyst something.
Upload, sanitize and review in LogTotal
LogTotal reads syslog-style text, JSON and EVTX. Text and JSON uploads go through the sanitize step before analysis.
- Upload. Open logtotal.com and drop in your export.
- Sanitize.
- Review.
FAQ
My SIEM isn’t in the table. Does this still work?
Yes. The rules above apply to any platform: find the API or CLI route, export raw events for a tight window, and flatten JSON to one event per line. We’re adding guides for the rest of the 65+ platforms SOC Prime supports.
Why not just analyze it in the SIEM?
Often you should. A file-based check is for when you want a second set of detections, need to share data with someone outside, or want to test what your SIEM might be missing.
