> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion-vendor-support.md).
# External data ingestion vendor support
{% hint style="info" %}
### Notice
Ingestion of logs and data requires a Cortex XDR Pro per GB license.
{% endhint %}
{% hint style="info" %}
### Note
New Cortex XDR licenses that are purchased from October 1st, 2025 and onwards will no longer support the data collectors marked with an asterisk (\*). For comprehensive data collector support, consider upgrading to an XSIAM license.
{% endhint %}
To provide you with a more complete and detailed picture of the activity involved in an incident, you can ingest data from a variety of external, third-party sources into Cortex XDR.
Cortex XDR can receive logs, or both logs and alerts, from the source. Depending on the data source, Cortex XDR can provide visibility into your external data in the form of:
* Log stitching with other logs in order to create network or authentication stories.
* Raw data in queries from XQL Search.
* Alerts reported by the vendor throughout Cortex XDR, such as in the alerts table, incidents, and views.
* Alerts raised by Cortex XDR on log data, such as analytics alerts.
To ingest data, you must set up the Syslog Collector applet on a Broker VM within your network.
The following table summarizes the vendor data that can be ingested, according to log or data type.
| Log/Data Type | Vendor Support |
| ---------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Network Connections | |
| Authentication Services/Audit Logs | |
| Operation and System Logs from Cloud Providers | |
| Endpoint Logs | |
| Cloud Assets | |
| Custom External Sources | |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion-vendor-support.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.