topic Re: Looking for the ip addresses of Cortex XDR server that sending syslog messages in Cortex XDR Discussions

Looking for the ip addresses of Cortex XDR server that sending syslog messages

Antony_Chan — Fri, 04 Aug 2023 06:35:43 GMT

Dear LIVEcommunity,

I was looking to restrict the firewall rule by only whitelist a certain ip address to reach the syslog server sitting in DMZ.

Cortex XDR is one of application that I need to whitelist so that the syslog messages can reach the syslog server.

Does anyone know how I can get the complete list of Cortex XDR that send syslog messages?

Thank you.

Re: Looking for the ip addresses of Cortex XDR server that sending syslog messages

neelrohit — Fri, 04 Aug 2023 08:20:37 GMT

Hi @Antony_Chan ,

Thank you for writing to live community!

As I understand correctly, you intend to receive messages and alerts from Cortex XDR cloud to syslog receiver and hence you are creating allowlists on firewalls for specific IPs. For Cortex XDR communication to syslog reciever, you would need to whitelist the IPs as per the region where your Cortex XDR tenant is hosted in. The documentation is provided below:

Integrate a Syslog Reciever

Hope this helps! Please mark the response as "Accept as Solution" if it answers your query.

Re: Looking for the ip addresses of Cortex XDR server that sending syslog messages

Antony_Chan — Fri, 04 Aug 2023 08:39:29 GMT

Neel,

Thanks, this is helpful!