12-06-2024 12:01 PM - edited 12-06-2024 01:28 PM
Has anyone found a good approach for collecting logs from an API when there isn't an official Cortex XDR integration? For example, Automox has released a Splunk and DataDog app, but the custom collection in Cortex XDR isn't a good fit. We use the Broker VM for syslog, but most SaaS apps don't support syslog of course.
What are people using to get "unsupported" logs into Cortex (without upgrading to XSIAM)?
12-10-2024 12:52 PM
Hi @mgreer, thanks for reaching us using the Live Community.
XDR can't connect to an unsupported API to retrieve the events. You can create a HTTP Custom collector and send the logs to the tenant using the API and saving them in the configured dataset.
More info here: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Set-up-an-H...
Keep in mind that this will only store the events and no stitching or correlation with the alerts will be done. If you want to correlate events you can do it manually.
If this post answers your question, please mark it as the solution.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
