XDR Cortex Event Forwarding into AWS S3 bucket

[MBD-hunter]

Hi!
I am looking for a way to export raw endpoint data from Cortex XDR to AWS S3 bucket,

I saw in the Event Forwarding option that it's possible to export these logs into Google Cloud Platform (GCP) bucket,

so I look for a similar option just into AWS S3 bucket. 

Has anyone else figured something out to achieve this?

Thanks!

Cortex XDR

[neelrohit]

Hi @MBD-hunter , 

Thank you for reaching out to Live Community!

The event forwarding from Cortex XDR to external destinations is possible only with an add-on license for Event Forwarding. 

Please ensure you have the add-on license for the same and if not kindly discuss with your sales representatives for getting the feature set enabled for configuration.

Regards.

[MBD-hunter]

Hi!
Thanks, I will check.
But if I have the right license I will be able to forward the data to AWS as well? 
Because in the docs (step 3) it looks like it is only possible to GCP...

"To retrieve the data, access GCP Cloud Storage through the Service Account. 

The Destination section displays the details of the Google Cloud Platform (GCP) bucket where your data is stored for 14 days. The data is compressed and saved as a line-delimited JSON gzip file."

@neelrohit

[MBD-hunter]

Hi @neelrohit !

I checked and at the moment, we do not have a license, but we are looking into getting one.  
We need to know if it is possible to export the raw data from the endpoints to AWS S3 and not only to GCP.
Thanks again for the response!

[afurze · Accepted solution]

MBD-Hunter,

The bucket is maintained by Palo Alto, not the customer.  Buckets are only hosted in GCP.