Push Cortex XDR datasets/logs to dedicated syslog server

[S.Galabada084004]

Hi everyone,
I’m looking for some guidance on whether it’s possible to forward Cortex datasets to a dedicated syslog server for long‑term retention. Has anyone successfully done this, or is there a recommended method?
I’m also considering using Microsoft Sentinel as a destination, but I’m not sure if all Cortex datasets can be pushed there.
Any insights or experience would be appreciated.

Cortex XDR 

[jmazzeo · Accepted solution]

Hi @S.Galabada084004,

You have two options to forward the XDR events to a third party tool:

• Log forwarding: allows you to forward the Issues, Cases and audit logs to external services like is described in this document.
• Event forwarding: this is an add-on that allows you to forward the RAW logs to a Google Cloud bucket provided by Palo Alto. Then from that bucket you can extract the logs with any third party tool. The logs are stored there up to 7 days. You can find more information in this doc.

If this reply answer your question, please mark it as the solution.

Thanks

[S.Galabada084004]

Thank you for the clarification JM. Just to confirm: if we use event forwarding, would we then be able to pull all the data from the Google Cloud bucket and push it into a separate VM that we manage?