[Data Ingestion and Integration] When onboarding a Palo Alto Networks NGFW to Cortex XDR, what must be done to confirm that logs are being ingested successfully after a device is selected and verified?

After onboarding a next-generation firewall, Palo Alto Networks instructs administrators to run an XQL search (e.g., dataset = panwngfwtraffic | limit 10) to confirm that firewall log events are reaching Cortex XDR. Successful query results verify ingestion immediately without waiting for incidents or certificate checks.

B. Incidents may not occur promptly; waiting provides no verification of log flow.
C. Certificate validity is required for log forwarding but does not confirm logs are being ingested.
D. Retrieving the certificate does not test log reception within Cortex XDR.

1. Cortex XDR Administrator’s Guide 3.9, “Onboard Your Palo Alto Networks NGFW”, Step 8 ‘Verify Log Ingestion with an XQL Query’. (pdf p.107).

2. Cortex XDR XQL Query Language Guide 3.9, Example “dataset=panwngfwtraffic”. (pdf p.18).