topic Re: Push Cortex XDR datasets/logs to dedicated syslog server in Cortex XDR Discussions

Push Cortex XDR datasets/logs to dedicated syslog server

S.Galabada084004 — Wed, 28 Jan 2026 23:49:22 GMT

Hi everyone,
I’m looking for some guidance on whether it’s possible to forward Cortex datasets to a dedicated syslog server for long‑term retention. Has anyone successfully done this, or is there a recommended method?
I’m also considering using Microsoft Sentinel as a destination, but I’m not sure if all Cortex datasets can be pushed there.
Any insights or experience would be appreciated.

Re: Push Cortex XDR datasets/logs to dedicated syslog server

jmazzeo — Thu, 29 Jan 2026 11:56:12 GMT

Hi @S.Galabada084004,

You have two options to forward the XDR events to a third party tool:

Log forwarding: allows you to forward the Issues, Cases and audit logs to external services like is described in this document.
Event forwarding: this is an add-on that allows you to forward the RAW logs to a Google Cloud bucket provided by Palo Alto. Then from that bucket you can extract the logs with any third party tool. The logs are stored there up to 7 days. You can find more information in this doc.

If this reply answer your question, please mark it as the solution.

Thanks

Re: Push Cortex XDR datasets/logs to dedicated syslog server

S.Galabada084004 — Thu, 29 Jan 2026 22:58:04 GMT

Thank you for the clarification JM. Just to confirm: if we use event forwarding, would we then be able to pull all the data from the Google Cloud bucket and push it into a separate VM that we manage?