Cortex Xsiam Data Ingestion Xdr Data Payload Structure

{
  "$schema": "https://json-structure.org/meta/core/v0/#",
  "$id": "https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/json-structure/cortex-xsiam-data-ingestion-xdr-data-payload-structure.json",
  "name": "XdrDataPayload",
  "description": "The payload structure for XDR data forwarding from integrated Palo Alto Networks products. Contains product identification, tenant context, event identification, and the forwarded telemetry content for correlation in the XSIAM unified data lake.\n",
  "type": "object",
  "properties": {
    "dataset": {
      "type": "string",
      "description": "The target XSIAM dataset name for the forwarded XDR data.\n"
    },
    "vendor": {
      "type": "string",
      "description": "The Palo Alto Networks product vendor designation for the forwarding source. Typically 'Palo Alto Networks'.\n"
    },
    "product": {
      "type": "string",
      "description": "The specific Palo Alto Networks product forwarding XDR data, such as Cortex XDR Agent, PAN-OS, Prisma Access, or Strata Logging Service.\n"
    },
    "log_type": {
      "type": "string",
      "description": "The XDR data type or telemetry category being forwarded (e.g., xdr_data, endpoint_event, network_event).\n"
    },
    "raw_log": {
      "type": "string",
      "description": "The raw XDR telemetry content as serialized JSON from the forwarding product. Contains all available event fields from the source product's data model.\n"
    },
    "timestamp": {
      "type": "datetime",
      "description": "The ISO 8601 date-time string indicating when the XDR event was captured by the source product.\n"
    },
    "tenant_id": {
      "type": "string",
      "description": "The XSIAM tenant identifier to which this XDR data belongs. Ensures forwarded data is routed to the correct tenant environment in multi-tenant deployments.\n"
    },
    "event_id": {
      "type": "string",
      "description": "A unique identifier for this forwarded XDR event, used for deduplication, correlation, and audit trail tracking.\n"
    }
  },
  "required": [
    "dataset",
    "vendor",
    "product",
    "log_type",
    "raw_log",
    "timestamp",
    "tenant_id",
    "event_id"
  ]
}