alert creation when live terminal is launch

damien_lucas — Wed, 13 Aug 2025 11:57:21 GMT

hello

is it possible to create a automatic mail or alerte to be cache by a siem when someone launch a live terminal on a endpoint from the tenant?

if yes how ?

Best Regards,

D.L

Re: alert creation when live terminal is launch

jmazzeo — Wed, 13 Aug 2025 12:12:31 GMT

The Live Terminal connections logs are stored in the Management Audit Logs in the console, in the Settings menu.

With this logs, you can create a Notification Forwarding rule to send this events via email or to a syslog server. More details in this guide: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-3.x-Documentation/Configure-notification-forwarding

If this post answers your question, please mark it as the solution.