topic Re: XDR Cortex Event Forwarding into AWS S3 bucket in Cortex XDR Discussions

XDR Cortex Event Forwarding into AWS S3 bucket

MBD-hunter — Thu, 08 Sep 2022 10:09:52 GMT

Hi!
I am looking for a way to export raw endpoint data from Cortex XDR to AWS S3 bucket,

I saw in the Event Forwarding option that it's possible to export these logs into Google Cloud Platform (GCP) bucket,

so I look for a similar option just into AWS S3 bucket.

Has anyone else figured something out to achieve this?

Thanks!

Re: XDR Cortex Event Forwarding into AWS S3 bucket

neelrohit — Thu, 08 Sep 2022 11:14:44 GMT

Hi @MBD-hunter ,

Thank you for reaching out to Live Community!

The event forwarding from Cortex XDR to external destinations is possible only with an add-on license for Event Forwarding.

Please ensure you have the add-on license for the same and if not kindly discuss with your sales representatives for getting the feature set enabled for configuration.

Regards.

Re: XDR Cortex Event Forwarding into AWS S3 bucket

MBD-hunter — Thu, 08 Sep 2022 14:58:39 GMT

Hi!
Thanks, I will check.
But if I have the right license I will be able to forward the data to AWS as well?
Because in the docs (step 3) it looks like it is only possible to GCP...

"To retrieve the data, access GCP Cloud Storage through the Service Account.

The Destination section displays the details of the Google Cloud Platform (GCP) bucket where your data is stored for 14 days. The data is compressed and saved as a line-delimited JSON gzip file."

@neelrohit

Re: XDR Cortex Event Forwarding into AWS S3 bucket

MBD-hunter — Wed, 14 Sep 2022 13:58:48 GMT

Hi @neelrohit !

I checked and at the moment, we do not have a license, but we are looking into getting one.
We need to know if it is possible to export the raw data from the endpoints to AWS S3 and not only to GCP.
Thanks again for the response!

Re: XDR Cortex Event Forwarding into AWS S3 bucket

afurze — Wed, 14 Sep 2022 14:15:50 GMT

MBD-Hunter,

The bucket is maintained by Palo Alto, not the customer. Buckets are only hosted in GCP.