Configure notification forwarding

Configure Cortex AgentiX notification forwarding for issues, cases, and audit logs to email, Slack, syslog, Splunk, Amazon S3, Amazon SQS, and webhooks.

After you integrate with an external service such as Slack, a syslog server, Amazon S3, Amazon SQS, Webhook, or Splunk, create a forwarding configuration that specifies the data or log type you want to forward. You can configure notifications for issues, cases, and logs. To send reports to email or Slack, see Reports.

Before you can select an external service for notification forwarding, you must integrate the external service with Cortex AgentiX. For more information, see Configure external applications for forwarding. No prior configuration is required to send data to an email distribution list.

Configure notifications

1. Select Settings → Configurations → General → Notifications → Add Forwarding Configuration.
2. Enter a name for the configuration.
3. Select the data or log type you want to forward:

   • Issues: Send notifications for specific issue types.

     • Forwarding destinations: Only issues and cases can be forwarded to Slack, Splunk, Amazon SQS, Amazon S3, or Webhook.
     • Notification forwarding by domain: To configure notification forwarding for issues by domain, select Issues and filter the Issues table by Issue Domain.
     • Alert vs. issue format: By default, new configurations use the issue format, but you can select the alert format if needed when forwarding to email, Slack, or a syslog server. You cannot forward issues in the alert format to Splunk, Amazon SQS, Amazon S3, or Webhook.

       Existing legacy configurations are not automatically updated and continue to send notifications in the alert format. To use the issue format, edit the existing configuration.
   • Management Audit Logs: Send notifications for audit logs about events related to your Cortex AgentiX tenant.
   • Cases: Send notifications for specific cases.

     Not all data and log types can be sent to all external services. For more information, see Forward logs and data from Cortex AgentiX to external services.
4. (Optional) Enter a description of the forwarding configuration.
5. Click Next. Under Scope, filter the issues, cases, or logs to include in a notification.

   For example, if a filter is set to Severity = Medium, Category = Configuration, Cortex AgentiX sends matching issues or events as a notification.
6. Click Next.
7. Select email or the external service you want to forward to.

Email (Issues, cases, logs)

1. Enable the email option and click Email to expand the form.
2. Enter the email address for your Distribution List.
3. For issue forwarding, define the Grouping Timeframe in minutes. It specifies how often Cortex AgentiX sends notifications. Every 20 issues aggregated within this time frame are sent together in one notification, sorted by severity. To send a notification when one issue is generated, set the time frame to 0. The grouping time frame for cases and management audit logs is 10 minutes and cannot be modified.
4. (Optional) Define your email configuration:

   1. In the Distribution List, add the email addresses to which you want to send email notifications.
   2. Choose whether you want Cortex AgentiX to provide an auto-generated subject.
5. Choose whether you want Cortex AgentiX to provide an auto-generated subject or enter your own subject.

The Grouping Timeframe specifies how often Cortex AgentiX sends notifications, in minutes. Every 20 issues or events aggregated within this time frame are sent together in one notification, sorted by severity. To send a notification when one issue or event is generated, set the time frame to 0.

Syslog server (Issues, logs)

Enable the Syslog option and click Syslog to expand the form.

Select a syslog receiver. Cortex AgentiX displays the list of receivers integrated with your Cortex AgentiX tenant.

Slack (Issues, cases)

Enable the Slack option and click Slack to expand the form.

Enter the Slack channel name and select from the list of available channels. Slack channels are managed independently of Cortex AgentiX in your Slack workspace. After integrating your Slack account with your Cortex AgentiX tenant, Cortex AgentiX displays a list of specific Slack channels associated with the integrated Slack workspace.

Amazon S3, Amazon SQS, Splunk, or Webhook (Issues, cases)

Enable the Amazon S3, Amazon SQS, Splunk, or Webhook option and click the service to expand the form.

Select the instance name.

1. Click Next.
2. Review the forwarding configuration and click Create.