> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-cloud-to-external-services/configure-notification-forwarding.md). # Configure notification forwarding After you integrate with an external service such as Slack, a syslog server, Amazon S3, Amazon SQS, Webhook, or Splunk, create a forwarding configuration that specifies the data or log type you want to forward. You can configure notifications for issues, cases, and logs. To send reports to email or Slack, see [Run or schedule reports](/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/manage-dashboards-and-reports/reports.md). {% hint style="warning" %} ### Prerequisite Before you can select an external service for notification forwarding, you must integrate the external service with Cortex Cloud. For more information, see [Configure external applications for forwarding](/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-cloud-to-external-services/configure-external-applications-for-forwarding.md). No prior configuration is required to send data to an email distribution list. {% endhint %} How to configure notifications 1. Select Settings → **Configurations** → **General** → **Notifications** → **Add Forwarding Configuration**. 2. Enter a name for the configuration. 3. Select the data or log type you want to forward: * **Issues:** Send notifications for specific issue types.

Note

* **Agent Audit Logs:** Send notifications for audit logs reported by your Cortex XDR agents. * **Management Audit Logs:** Send notifications for audit logs about events related to your Cortex Cloud tenant. * **Cases**—Send notifications for specific cases.

Note

Not all data and log types can be sent to all external services. For more information, see Forward logs and data from Cortex Cloud to external services.

4. (Optional) Enter a description of the forwarding configuration. 5. Click **Next**, and under **Scope**, filter which issues, cases, or logs you want included in a notification. For example, for a filter set to `Severity = Medium, Category = Configuration`, Cortex Cloud sends the issues or events matching this filter as a notification. 6. Click **Next**. 7. Select email or the external service you want to forward to.
Email (Issues, cases, logs) 1. Enable the email option and click **Email** to expand the form. 2. Enter the email address for your **Distribution List**. 3. For issue forwarding, you can define the **Grouping Timeframe**, which is the time frame, in minutes, to specify how often Cortex Cloud sends notifications. Every 20 issues aggregated within this time frame are sent together in one notification, sorted according to severity. To send a notification when one issue is generated, set the time frame to **`0`**. The grouping time frame for case and management audit log is 10 minutes and cannot be modified. 4. (Optional) Define your email configuration: 1. In the **Distribution List**, add the email addresses to which you want to send email notifications. 2. Choose whether you want Cortex Cloud to provide an auto-generated subject. 3. Choose the format you want to send the email. If you choose **Alert**, you can choose the **Standard** or **Legacy** format. For more information about the legacy format, see [Log format for IOC and BIOC issues](/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/data-and-log-notification-formats/log-format-for-ioc-and-bioc-issues.md). 5. Choose whether you want Cortex Cloud to provide an auto-generated subject or enter your own subject. 6. By default, data is sent in the issue format. You can also choose **Alert** format, **Standard** or **Legacy**. For more information about the legacy format, see [Log format for IOC and BIOC issues](/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/data-and-log-notification-formats/log-format-for-ioc-and-bioc-issues.md). {% hint style="info" %} The **Grouping Timeframe** defines the time frame, in minutes, of how often Cortex Cloud sends notifications. Every 20 issues or 20 events aggregated within this time frame are sent together in one notification, sorted according to severity. To send a notification when one issue or event is generated, set the time frame to **`0`**. {% endhint %}
Syslog server (Issues, logs) 1. Enable the Syslog option and click **Syslog** to expand the form. 2. Select a syslog receiver. Cortex Cloud displays the list of receivers integrated with your Cortex Cloud tenant. 3. Choose the format you want to send the syslog. If you choose **Alert**, you can choose the **Standard** or **Legacy** format. For more information about the legacy format, see [Log format for IOC and BIOC issues](/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/data-and-log-notification-formats/log-format-for-ioc-and-bioc-issues.md).
Slack (Issues, cases) 1. Enable the Slack option and click **Slack** to expand the form. 2. Enter the Slack channel name and select from the list of available channels. Slack channels are managed independently of Cortex Cloud in your Slack workspace. After integrating your Slack account with your Cortex Cloud tenant, Cortex Cloud displays a list of specific Slack channels associated with the integrated Slack workspace. 3. Choose the format you want to send the syslog. If you choose **Alert**, you can choose the **Standard** or **Legacy** format. For more information about the legacy format, see [Log format for IOC and BIOC issues](/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/data-and-log-notification-formats/log-format-for-ioc-and-bioc-issues.md).
Amazon S3, Amazon SQS, Splunk, or Webhook (Issues, cases) 1. Enable the Amazon S3, Amazon SQS, Splunk, or Webhook option and click to expand the form. 2. Select the instance name.
8. Click **Next**. 9. Review the forwarding configuration and click **Create**. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-cloud-to-external-services/configure-notification-forwarding.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.