> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/data-management/manage-event-forwarding.md). # Manage Event Forwarding {% hint style="warning" %} ### Prerequisite Event Forwarding requires **View/Edit** RBAC permissions for **Data Management** (under **Configurations** → **Data Management**), which are the same permissions required for Parsing Rules, Data Model Rules, and Dataset Management. {% endhint %} You can save your ingested, parsed data in an external location by exporting your event logs to a temporary storage bucket on Google Cloud Platform (GCP). {% hint style="info" %} ### Note After exporting logs, you can download them from GCP for up to 14 days. The Pub/Sub subscription messages are available for 7 days. {% endhint %} Event forwarding has the following purposes: * Compliance: You may have specific compliance requirements to retain logs in a separate, secure environment for long-term storage or auditing purposes. * Long-term archive: The core function is to export the event logs that the tenant has ingested and parsed to a storage location outside of the XSIAM tenant. This provides you with a copy of the normalized and processed data. * External analytics: Download the exported event logs for use in other security tools, data analysis platforms, or for offline forensic investigation. You can forward the following events to GCP: * Endpoints Event Forwarding Forwards raw, high-fidelity security telemetry collected by EDR, including data from endpoints through the XDR Agent and cloud workloads (VMs, containers, or third-party EDRs). The exported logs are raw data, without any stories, and export a subset of the endpoint data without filtering or configuration options.

Note

Requires the Endpoints Event Forwarding add-on.

* GB Event Forwarding Covers all other security data measured by daily ingestion volume (in Gigabytes). This includes non-endpoint logs such as firewall traffic, cloud audit logs, network flow logs, identity data, and general Syslogs from servers and devices. The exported logs are raw data, without any stories, and export all the data without filtering or configuration options.

Note

Requires the GB Event Forwarding add-on

Use the **Event Forwarding** page to activate Event Forwarding, to retrieve the path and credentials of your external storage destination on GCP. Once this page is activated, Cortex AgentiX automatically creates the GCP bucket. {% hint style="info" %} ### Important Since data is aggregated and compressed, it may take up to two hours until the data is available in the forwarding bucket. {% endhint %} **Upload to a temporary GCP storage bucket** Before you begin, ensure that you have the view/edit permission for Data Management. Instance Administrators have this permission by default. 1. Under **Settings** → **Configurations** → **Data Management** → **Event Forwarding**, activate one or more of the following: * **Enable GB Event Forwarding** 2. **Save** your selection. The **Destination** section displays the details of the GCP bucket created by Cortex AgentiX, where your data is stored for 14 days. The data is compressed and saved as a line-delimited JSON gzip file. 3. Access GCP Cloud Storage using a Service Account. 1. **Copy** the storage path displayed. 2. **Generate and download** the Service Account JSON WEB TOKEN, which contains the access key. Save it in a secure location. If you need to regenerate the access token, **Replace and download** a new token. This action invalidates the previous token. The token provides access to all your data stored in this bucket. It must be saved in a safe place. Use the storage path and access key to manually retrieve your files or use an API for automated retrieval. 3. Using the storage path and access key, retrieve your files manually or using an API. * [Authenticate using service account credentials](https://cloud.google.com/docs/authentication/provide-credentials-adc#service-account) * [Copy objects using gcloud storage](https://cloud.google.com/sdk/gcloud/reference/storage/cp) 4. (Optional) Use the Pub/Sub subscription to ensure reliable data retrieval without any loss. 1. **Copy** the Pub/Sub subscription provided. 2. Configure your application or system to receive messages from the Pub/Sub subscription. Whenever a new file is added to the GCS bucket, a message is sent to the Pub/Sub subscription. The object path of the file in the bucket has the prefix `internal/`. 3. Process the received message to initiate the download of the corresponding file. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/data-management/manage-event-forwarding.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.