Follow Cortex XSIAM uses the same XQL query APIs as Cortex XDR: start a query, wait for results, and use a stream for anything over 1,000 rows. What’s different is the data. Third-party logs land in raw datasets, usually named <vendor>_<product>_raw, and the original log line sits in the _raw_log field. Select that field, and the export gives you back exactly what the source sent.
XSIAM is Palo Alto Networks’ SOC platform, and it’s where many former QRadar SaaS customers ended up after the 2024 deal. Prime Core has more than 24,000 unique detection rules, mapped to 676 MITRE ATT&CK techniques. Below is how to get data out, sanitize it, and investigate it for free in LogTotal.
Before you start
An API key and URL. Create a key with a role that can run XQL queries; note the key, its ID and the API URL shown with it.
Find the dataset. In the Query Builder, list datasets (dataset = offers suggestions). Raw third-party data follows the <vendor>_<product>_raw pattern, for example fortinet_fortigate_raw. Endpoint telemetry is in xdr_data.
Hot and cold storage. Recent data is in hot storage and queries quickly. Older data may be in cold storage, which needs its own query approach and costs more quota.
Export with the XQL APIs
To get raw lines from a FortiGate dataset:
dataset = fortinet_fortigate_raw
| filter _raw_log contains "web-03"
| fields _time, _raw_log
Run it through start_xql_query and get_query_results (plus get_query_results_stream above 1,000 rows), as in the Cortex XDR guide. Then turn the JSON into raw lines:
jq -r '._raw_log' xsiam_fortigate_1019.jsonl > xsiam_fortigate_1019.log
For normalized data across sources, query the data model (XDM) instead. You get consistent field names, but not the original wording.
Upload, sanitize and review in LogTotal
- Upload. Open logtotal.com and drop in the file: raw lines from _raw_log, or the JSON rows.
- Sanitize.
- Review.
When it goes wrong
| Symptom | Likely cause | Fix |
|---|---|---|
| Dataset not found | Name differs in your tenant | List datasets in the Query Builder |
| _raw_log is empty | The source was ingested as structured data | Export the parsed fields instead |
| Exactly 1,000 results | Stream not used | Use get_query_results_stream |
| Quota errors | XQL quota used, or cold storage queries | Narrow the window; check quota |
| Old data missing | It’s in cold storage | Query cold storage, or restore it |
FAQ
Raw or XDM?
Raw (_raw_log) for LogTotal, because it keeps the source’s own format. XDM when you need the same fields across many sources.
I moved from QRadar SaaS. Is my old data here?
That depends on your migration. Check which datasets hold the migrated history.
