alert creation when live terminal is launch

[damien_lucas]

hello

is it possible to create a automatic mail or alerte to be cache by a siem when someone launch a live terminal on a endpoint from the tenant?

if yes how ?

Best Regards,

D.L

[jmazzeo · Accepted solution]

Hi @damien_lucas,

The Live Terminal connections logs are stored in the Management Audit Logs in the console, in the Settings menu.

With this logs, you can create a Notification Forwarding rule to send this events via email or to a syslog server. More details in this guide: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-3.x-Documentation/Configure-notific...

If this post answers your question, please mark it as the solution.