Integrate Cortex XDR with the SIEM (Microsoft Azure) solution

[Shashanksinha]

 Integration of Cortex XDR with the SIEM (Microsoft Azure) solution 
Had a few queries regarding it:- 
1. Supported integration methods & recommended integration methods for integration with Microsoft Sentinel.
2. What all logs can be forwarded (eg: Alerts, Incidents, Audit, management logs and endpoint/server logs, etc.)
3. How do we evaluate disk space requirements for such events?
4. Reference documents for this integration

[neelrohit]

Hi @Shashanksinha ,

Thank you for writing to live community!

SIEM integration with Cortex XDR can be done in two mechanisms:

1. Using syslog receiver
2. API keys

Depending upon your used case, you can integrate syslog receiver as mentioned in the guide here: Integrate a Syslog receiver 

This will require you to whitelist the IP as per your region in which the XDR tenant is hosted and then navigate to Settings> Configurations> Integrations>External Applications. Add your syslog reciever public IP and certificate.

For API based integration, please create a curl or a python based API as supported by Microsoft Azure Sentinel and configure it in the app.