Configure Notification Forwarding

With Cortex XDR you can choose to receive notifications to keep up with the alerts
and events
that matter to your teams. To forward notifications, you create a forwarding configuration that specifies the log type you want to forward. You can also add filters to your configuration to send notifications that match specific criteria.
Cortex XDR applies the filter only to future alerts
and events
.
Use this workflow to configure notifications for alerts
, agent audit logs, and management audit logs
. To receive notifications about reports, see Create a Report from Scratch.
  1. Navigate to
    gear.png
    Settings
    Notifications
    .
  2. + Add Forwarding Configuration
    .
  3. Define the configuration
    Name
    and
    Description
    .
  4. Select the
    Log Type
    you want to forward, one of the following:
    • Alerts
      —Send notifications for specific alert types (for example, XDR Agent
      or BIOC
      ).
    • Agent Audit Logs
      —Send notifications for audit logs reported by your Cortex XDR agents.
    • Management Audit Logs
      —Send notifications for audit logs about events related to your Cortex XDR management console.
  5. In the
    Configuration Scope
    ,
    Filter
    the type of information you want included in a notification.
    For example, set a filter
    Severity = Medium, Alert Source = XDR Agent
    . Cortex XDR sends the alerts or events matching this filter as a notification.
  6. Define your
    Email Configuration
    .
    1. In
      Email Distribution
      , add the email addresses to which you want to send email notifications.
    2. Define the
      Email Grouping Time Frame
      , in minutes, to specify how often Cortex XDR sends notifications. Every 30 alerts
      or 30 events
      aggregated within this time frame are sent together in one notification, sorted according to the severity. To send a notification when one alert
      or event
      is generated, set the time frame to
      0
      .
    3. Choose whether you want Cortex XDR to provide an auto-generated subject.
    4. If you previously used the Log Forwarding app and want to continue forwarding logs in the same format, you can
      Use Legacy Log Format
      . See Cortex XDR Log Notification Formats.
  7. Configure additional forwarding options:
    Depending on the notification integrations supported by the Log Type, configure the desired notification settings.
  8. (
    Optional
    ) To later modify a saved forwarding configuration, right-click the configuration, and
    Edit
    ,
    Disable
    , or
    Delete
    it.

Recommended For You