- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
10-27-2023 06:08 AM - last edited on 04-18-2024 11:36 AM by emgarcia
Hello,
I have been doing some searching on if I can get XDR endpoint logs like processes and etc into a third party SIEM.
Based on the XDR API there is no way to export events (You can technically run XQL queries using the API but this would get logged on XDR)
It also looks like you cannot actually forward XDR data from the data lake to a syslog server and then to your SIEM.
So if I am not wrong there is no way to export endpoint events from XDR to a third party SIEM.
Can I get a confirmation on this and that I am not missing anything?
Thanks.
10-27-2023 06:37 AM
Hi @AvesterFahimipour ,
Thank you for writing to live community!
Cortex XDR agent based logs are aggregated and stored in XDR data layer itself. Infact with that being said, we are anyways deprecating the concept of different data lakes for third party source data and all of the logs will be streamed by XDR.
Coming back to the use case of attempting forwarding of raw events from Cortex XDR, inorder to achieve this action, customers need to have Cortex XDR Event forwarding license. This license comes in two parts:
The Event Forwarding license allows you to forward data into available GCP buckets where your data is stored for 14 days. The data is compressed and saved as a line-delimited JSON gzip file.
For more details you can review here: Manage Event Forwarding
Once, you have the license, the event forwarding option is listed under Data Management on the Configuration page of Cortex XDR.
Hope this helps! Please mark the response as "Accept as Solution" if it answers your query
10-30-2023 04:56 AM
Hi @AvesterFahimipour ,
Please check your license page if you have already procured it. The license window should refer to an entitlement as shown in the screenshot below for Endpoint agent event forwarding.
If not, you might want to reach out to your sales engineer or the local accounts team for procurement.
10-27-2023 06:37 AM
Hi @AvesterFahimipour ,
Thank you for writing to live community!
Cortex XDR agent based logs are aggregated and stored in XDR data layer itself. Infact with that being said, we are anyways deprecating the concept of different data lakes for third party source data and all of the logs will be streamed by XDR.
Coming back to the use case of attempting forwarding of raw events from Cortex XDR, inorder to achieve this action, customers need to have Cortex XDR Event forwarding license. This license comes in two parts:
The Event Forwarding license allows you to forward data into available GCP buckets where your data is stored for 14 days. The data is compressed and saved as a line-delimited JSON gzip file.
For more details you can review here: Manage Event Forwarding
Once, you have the license, the event forwarding option is listed under Data Management on the Configuration page of Cortex XDR.
Hope this helps! Please mark the response as "Accept as Solution" if it answers your query
10-30-2023 04:50 AM
One more question:
How do we get the event forwarding license, I cannot find it anywhere.
10-30-2023 04:56 AM
Hi @AvesterFahimipour ,
Please check your license page if you have already procured it. The license window should refer to an entitlement as shown in the screenshot below for Endpoint agent event forwarding.
If not, you might want to reach out to your sales engineer or the local accounts team for procurement.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!