Looking for the ip addresses of Cortex XDR server that sending syslog messages

[Antony_Chan]

Dear LIVEcommunity,

I was looking to restrict the firewall rule by only whitelist a certain ip address to reach the syslog server sitting in DMZ.

Cortex XDR is one of application that I need to whitelist so that the syslog messages can reach the syslog server.

Does anyone know how I can get the complete list of Cortex XDR that send syslog messages?

Thank you.

[neelrohit · Accepted solution]

Hi @Antony_Chan ,

Thank you for writing to live community!

As I understand correctly, you intend to receive messages and alerts from Cortex XDR cloud to syslog receiver and hence you are creating allowlists on firewalls for specific IPs. For Cortex XDR communication to syslog reciever, you would need to whitelist the IPs as per the region where your Cortex XDR tenant is hosted in. The documentation is provided below:

Integrate a Syslog Reciever

Hope this helps! Please mark the response as "Accept as Solution" if it answers your query.

[Antony_Chan]

Neel,

Thanks, this is helpful!