Integrating Log Audit Management XDR / XSOAR

[A.Faruq]

Dear Community,

Is there any documentation about how to integrate Audit Management XDR and XSOAR for a SIEM like Elastic? I need a centralized log audit for monitoring.

Thanks

[eluis]

Hi A.Faruq, 

It is possible to integrate and send Audit Management logs to a SIEM, like Elastic search or other, There is no native integration, but there is a possibility to do such by:

1- Create a new syslog server configuration. Please follow the doc below, and ensure you are following the prerequisites:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/Integrate-a-syslog-re...

2- Configure a new notification forwarding selecting the scope as Management Audit Logs which is what you want to send to your Elastic instance. In this step, the syslog server where you send the Management Audit Logs is the one you have created in the previous step. Please check the doc: 
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Cloud-Documentation/Configure-notif...

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR, 

Luis