[Cortex XDR ] Does Broker VM support tandem log dumping? Can you dump to more than 2 external storage systems at the same time (3rd party SIEM...)

S.Lin576639 — Mon, 17 Jun 2024 05:48:56 GMT

Hi Everyone,

I have encountered two Broker VM log collection and dumping problems want to ask, and then please help you help, the problem is as follows:

1. Can Broker VM tandem dump logs?

Description: As shown in the figure below, a customer wants to collect external syslogs through the syslog collector function of Broker VM A, but instead of uploading the collected logs to Cortex Data Lake directly, the customer will dump them to another Broker VM B, which will upload the logs to the Data Lake, Is this part supported and is it possible? How to configure it?

2. Can you dump to more than 2 external storage systems at the same time (3rd party SIEM...)

In addition to collecting external syslog information through the syslog collector function, can Broker VM dump these logs? For example, in the figure below, after collecting syslog information through Broker VM syslog collector => When uploading the data to Data Lake, is it possible to export the data to other storage systems (e.g. third-party SIEM system, Syslog Receiver, Database) for saving?

Thank you in advance for your help.

topic [Cortex XDR ] Does Broker VM support tandem log dumping? Can you dump to more than 2 external storage systems at the same time (3rd party SIEM...) in Endpoint (Traps) Discussions

[Cortex XDR ] Does Broker VM support tandem log dumping? Can you dump to more than 2 external storage systems at the same time (3rd party SIEM...)