Integrating Log Audit Management XDR / XSOAR

A.Faruq — Mon, 14 Jul 2025 01:50:14 GMT

Dear Community,

Is there any documentation about how to integrate Audit Management XDR and XSOAR for a SIEM like Elastic? I need a centralized log audit for monitoring.

Thanks

Re: Integrating Log Audit Management XDR / XSOAR

eluis — Tue, 15 Jul 2025 11:35:21 GMT

Hi A.Faruq,

It is possible to integrate and send Audit Management logs to a SIEM, like Elastic search or other, There is no native integration, but there is a possibility to do such by:

1- Create a new syslog server configuration. Please follow the doc below, and ensure you are following the prerequisites:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/Integrate-a-syslog-receiver

2- Configure a new notification forwarding selecting the scope as Management Audit Logs which is what you want to send to your Elastic instance. In this step, the syslog server where you send the Management Audit Logs is the one you have created in the previous step. Please check the doc:
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Cloud-Documentation/Configure-notification-forwarding#

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis

topic Re: Integrating Log Audit Management XDR / XSOAR in Cortex XDR Discussions

Integrating Log Audit Management XDR / XSOAR

Re: Integrating Log Audit Management XDR / XSOAR