Broker VM & SIEM

MAghabayli — Wed, 21 Dec 2022 12:02:08 GMT

Hello folks.

How we can forward Cortex Agent logs from Broker VM to SIEM systems?

[agent] ====> [Broker VM] ====> [SIEM]

Re: Broker VM & SIEM

neelrohit — Wed, 21 Dec 2022 14:45:40 GMT

This model is not possible. You cannot forward agent logs to SIEM using the broker VM.

SIEM integration is done via APIs or Syslog server integration to Cortex XDR.

for more details, please refer: Integrate A Syslog Reciever