Integration With Other SIEM

[G.Anshar]

Hello,

I want to integrate Cortex XDR with Logrythm (on-prem) problem is the SIEM can't open access to internet, is there any solution ? 

Thank You

[eluis]

Hi @G.Anshar 

if you want to send logs from another SIEM to the XDR tenant, you can use the Broker VM activating the syslog receiver applet. Recommended to send CEF formatted logs to the Broker VM the Broker will act as a proxy to reach the tenant. 

Remember you will need Pro per GB license to store the logs 

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". 

Thank you.

Luis