Palo Alto Cortex XDR integration with LogRhythm

Keita123 — Wed, 17 Jul 2024 09:27:21 GMT

Hello,
our customer request to integrate Cortex XDR to LogRhythm, but I couldn't find which port number used to onboard the logsource from Cortex XDR side. Any info?

Re: Palo Alto Cortex XDR integration with LogRhythm

jmazzeo — Wed, 24 Jul 2024 17:24:11 GMT

Hi @Keita123, thanks for reaching us using the Live Community.

You can send the XDR Alerts and audit logs to a Syslog Server with inbound internet access, and then create the syslog receiver in Cortex following this guide. Then, you can select what to forward to the syslog with the Notification Forwarding configuration in this other document.

If you need all the Raw logs from Cortex, not only the alerts or console audit logs, you need to purchase the Event Forwarding add-on, that gives access to a GCP Bucket with the logs, and then can be consumed by any other tool. More info here.

If this post answers your question, please mark it as the solution.

topic Re: Palo Alto Cortex XDR integration with LogRhythm in Cortex XDR Discussions

Palo Alto Cortex XDR integration with LogRhythm

Re: Palo Alto Cortex XDR integration with LogRhythm