: Forward Logs from Cortex Data Lake to an Email Server

Forward Logs from Cortex Data Lake to an Email Server

Table of Contents

Forward Logs from
Cortex Data Lake
to an Email Server

Learn how to forward logs from
Cortex Data Lake
to an email server.
To get email notifications whenever critical issues occur on your network, you can configure
Cortex Data Lake
to send notifications to an email destination.
Cortex Data Lake
uses the Palo Alto Networks SMTP server to forward log information in an email format, and all emails are sent from noreply@cs.paloaltonetworks.com. The communication between
Cortex Data Lake
and the email destination uses SMTP over TLS, and SMTP server certificate is signed by a trusted root CA.
  1. Sign In
    to the hub at https://apps.paloaltonetworks.com/.
  2. Select the
    Cortex Data Lake
    instance that you want to configure for email forwarding.
    If you have multiple
    Cortex Data Lake
    instances, hover over the
    Cortex Data Lake
    tile and then select an instance from the list of available instances.
  3. Configure email forwarding.
    You cannot add your SMTP server to
    Cortex Data Lake
    1. Select
      Log Forwarding
      to add a new email forwarding profile.
    2. Enter a descriptive
      for the profile.
    3. Enter the email address of the administrator
      whom you want to send email.
      You can enter up to ten additional email addresses, separated by commas, to add as
    4. Enter the
      Email Subject
      to clearly identify the purpose of the notification.
    5. Select the logs you want to forward.
      1. Add
        a new log filter.
      2. Select the
        Log Type
      3. (Optional)
        Create a log filter to forward only the logs that are most critical to you.
        You can either write your own queries from scratch or use the query builder. You can also select the query field to choose from among a set of common predefined queries.
        Log filters function like queries in Explore, with the following differences:
        • No double quotes (
        • No subnet masks. To return IP addresses with subnets, use the
          operator. Example:
          src_ip.value LIKE “192.1.1.%”
        If you want to forward all logs of the type you selected, do not enter a query. Instead, proceed to the next step.
      4. Save
        your changes.
      5. Add other log types for which you’d like to receive email notifications.
    6. Save
      your changes.
      Email forwarding is rate limited to allow 10 emails per second.
  4. Verify that the
    of your email forwarding profile is
    ( ).
  5. (Optional)
    You can use the running Email forwarding profile to forward past logs spanning up to 3 days.

Recommended For You