> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/visibility-of-logs-and-alerts-from-external-sources.md).
# Visibility of logs and alerts from external sources
{% hint style="info" %}
### Notice
Ingestion of logs and data requires a Cortex XDR Pro per GB license.
{% endhint %}
{% hint style="info" %}
### Note
New Cortex XDR licenses that are purchased from October 1st, 2025 and onwards will no longer support the data collectors marked with an asterisk (\*). For comprehensive data collector support, consider upgrading to an XSIAM license.
{% endhint %}
The following table describes the visibility of each vendor and device type, and where you can view information ingested from external sources, depending on the data source.
A  indicates support and a dash (—) indicates the feature is not supported.
Network connections
| Vendor and Device Type | Raw Data Visibility | Normalized Log Visibility | Cortex XDR Alert Visibility | Vendor Alert Visibility |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [Amazon S3 (flow logs)](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-network-connection-logs/ingest-network-flow-logs-from-amazon-s3.md) | 
Raw data is searchable in XQL Search.
|
Option to ingest network flow logs as Cortex XDR network connection stories that are searchable in the Query Builder and in XQL Search.
|
Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs.
Note
While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.
Raw data is searchable in XQL Search.
|
Option to ingest network Route 53 DNS logs as Cortex XDR network connection stories that are searchable in the Query Builder and in XQL Search.
|
Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs.
Note
While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.
Raw data is searchable in XQL Search.
| — |
Cortex XDR can raise Cortex XDR alerts (Correlation Rules only) when relevant from flow logs.
| — |
| [Azure Network Watcher (flow logs)](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-network-connection-logs/ingest-network-flow-logs-from-microsoft-azure-network-watcher.md) |
Raw data is searchable in XQL Search.
|
Option to ingest network flow logs as Cortex XDR network connection stories that are searchable in the Query Builder and in XQL Search.
|
Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from flow logs.
Note
While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.
Raw data is searchable in XQL Search.
Note
Logs with sessionid = 0 are dropped.
Network stories that include Check Point network connection logs are searchable in the Query Builder and in XQL Search.
Note
Logs with sessionid = 0 are dropped.
Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs.
Note
While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.
Alerts from Check Point firewalls are raised throughout Cortex XDR when relevant.
|
| [Corelight Zeek](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-network-connection-logs/ingest-logs-from-corelight-zeek.md) |
Raw data is searchable in XQL Search.
|
Network stories that include Corelight Zeek network connection logs are searchable in the Query Builder and in XQL Search.
|
Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs.
Note
While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.
Raw data is searchable in XQL Search.
|
Network stories that include Cisco network connection logs are searchable in the Query Builder and in XQL Search.
|
Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs.
Note
While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.
Raw data is searchable in XQL Search.
|
Network stories that include Fortinet network connection logs are searchable in the Query Builder and in XQL Search.
|
Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs.
Note
While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.
Alerts from Fortinet firewalls are raised throughout Cortex XDR when relevant.
|
| [Google Cloud Platform (flow logs, DNS logs)](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-network-connection-logs/ingest-logs-and-data-from-a-gcp-pubsub.md) |
Raw data is searchable in XQL Search.
|
Option to ingest network flow logs as Cortex XDR network connection stories and Google Cloud DNS logs that are searchable in the Query Builder and in XQL Search.
|
Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs.
Note
While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.
Raw data is searchable in XQL Search.
| — |
Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs.
Note
- While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.
- IOCs and BIOCs are only raised for these event types:
sso and session\_start.
Raw data is searchable in XQL Search.
| — | — | — |
| [Windows DHCP via Elasticsearch Filebeat](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-network-connection-logs/ingest-logs-from-windows-dhcp-using-elasticsearch-filebeat.md) |
Raw data is searchable in XQL Search.
|
Cortex XDR uses Windows DHCP logs to enrich your network logs with hostnames and MAC addresses that are searchable in XQL Search.
| — | — |
| [Zscaler Internet Access (ZIA)](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-network-connection-logs/ingest-logs-from-zscaler-internet-access.md) |
Raw data is searchable in XQL Search.
|
Network stories that include ZIA network connection and firewall logs are searchable in the Query Builder and in XQL Search.
|
Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs.
Note
- While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.
- Analytics, IOCs and BIOCs are only raised on the Firewall data.
- The Zscaler Nanolog Streaming Service (NSS) feed for web logs is only used for Correlation Rules and threat hunting.
Raw data is searchable in XQL Search.
|
Network stories that include ZPA network connection logs are searchable in the Query Builder and in XQL Search.
|
Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs.
Note
- While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.
- The Zscaler Nanolog Streaming Service (NSS) feed for web logs is only used for Correlation Rules and threat hunting.
Authentication services/Audit logs
| Vendor and Device Type | Raw Data Visibility | Normalized Log Visibility | Cortex XDR Alert Visibility | Vendor Alert Visibility |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------- |
| [Amazon S3 (audit logs)](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-authentication-logs-and-data/ingest-audit-logs-from-aws-cloud-trail.md) |
Logs and stories are searchable in XQL Search
|
Option to stitch audit logs with authentication stories that are searchable in the Query Builder and XQL Search.
|
Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs.
Note
While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.
Logs and stories are searchable in XQL Search
|
Option to stitch audit logs with authentication stories that are searchable in the Query Builder and XQL Search.
|
Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs.
Note
While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.
Raw data is searchable in XQL Search.
|
Option to stitch audit logs with authentication stories that are searchable in the Query Builder and XQL Search.
|
Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs.
Note
While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.
Raw data is searchable in XQL Search.
|
Relevant Login, Token, Google drive, SAML, Admin Console, Enterprise Groups, and Rules audit logs normalized into authentication stories. All are searchable in the Query Builder.
|
For all logs, Cortex XDR can raise Cortex XDR alerts (Analytics and Correlation Rules) when relevant from logs.
| — |
| [Microsoft 365 email](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-authentication-logs-and-data/ingest-logs-and-data-from-microsoft-365.md) |
Email logs are searchable in XQL Search
|
Microsoft 365 normalized email stories
|
For Microsoft 365 email logs, Cortex XDR can also raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from the email logs.
| — |
| [Microsoft Office 365](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-authentication-logs-and-data/ingest-logs-from-microsoft-office-365.md) |
Logs and stories (Azure AD authentication and audit logs only) are searchable in XQL Search
|
Azure AD authentication logs and Azure AD Sign-in logs normalized into authentication stories. Azure AD audit logs normalized to cloud audit logs stories. Exchange Online, SharePoint Online, and General audit logs normalized into stories. All are searchable in the Query Builder.
|
For all Microsoft Office 365 logs, Cortex XDR can also raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from Office 365 logs.
Note
While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.
Logs and stories are searchable in XQL Search
|
Logs stitched with authentication stories are searchable in the Query Builder.
|
Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules only) when relevant from logs.
Note
- While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.
- IOCs and BIOCs are only raised for these event types:
sso and session\_start.
Raw data is searchable in XQL Search.
|
All log types are normalized into authentication stories, and are searchable in the Query Builder.
|
Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs.
Note
While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.
Logs and stories are searchable in XQL Search
|
Logs stitched with authentication stories are searchable in the Query Builder.
|
Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs.
Note
While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.
Raw data is searchable in XQL Search
|
Logs stitched with authentication stories are searchable in the Query Builder.
|
Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs.
Note
While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.
Operation and system logs from cloud providers
| Vendor and Device Type | Raw Data Visibility | Normalized Log Visibility | Cortex XDR Alert Visibility | Vendor Alert Visibility |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [Azure Event Hub](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-network-connection-logs/ingest-logs-from-microsoft-azure-event-hub.md) |
Raw data is searchable in XQL Search.
| — |
Cortex XDR can raise Cortex XDR alerts (Correlation Rules only) when relevant from logs.
| — |
| [Google Cloud Platform](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-network-connection-logs/ingest-logs-and-data-from-a-gcp-pubsub.md) |
Raw data is searchable in XQL Search.
| — |
Cortex XDR can raise Cortex XDR alerts (Correlation Rules only) when relevant from logs.
| — |
| [Google Kubernetes Engine](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-operation-and-system-logs-from-cloud-providers/ingest-logs-from-google-kubernetes-engine.md) |
Raw data is searchable in XQL Search.
| — |
Cortex XDR can raise Cortex XDR alerts (Correlation Rules only) when relevant from logs.
| — |
| [Okta](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-network-connection-logs/ingest-logs-and-data-from-okta.md) |
Raw data is searchable in XQL Search.
| — |
Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs.
Note
While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.
Raw data is searchable in XQL Search.
|
Prisma Cloud alerts are stitched with Cloud Provider logs when relevant.
|
Cortex XDR can raise Cortex XDR alerts (Correlation Rules only) when relevant from logs.
|
Alerts from Prisma Cloud are raised throughout Cortex XDR when relevant.
|
| [Prisma Cloud Compute (alerts)](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/palo-alto-networks-integrations/ingest-alerts-from-prisma-cloud-compute.md) |
Raw data is searchable in XQL Search.
| — |
Cortex XDR can raise Cortex XDR alerts (Correlation Rules only) when relevant from logs.
|
Alerts from Prisma Cloud Compute are raised throughout Cortex XDR when relevant.
|
Endpoint logs
| Vendor and Device Type | Raw Data Visibility | Normalized Log Visibility | Cortex XDR Alert Visibility | Vendor Alert Visibility |
| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------- |
| [Windows Event Collector](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-data-collector-applets/activate-windows-event-collector.md) |
Windows event logs are available with agent EDR data and are searchable in XQL Search.
The normalized Windows event log data is also available in microsoft\_windows\_raw and is searchable in XQL Search.
|
Windows event logs are stitched with agent EDR data and are searchable in the Query Builder.
The Windows event logs are also normalized into the common Cortex Windows event format in microsoft\_windows\_raw and are searchable using the Query Builder.
|
Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs.
Note
While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.
Cloud assets
| Vendor and Device Type | Raw Data Visibility | Normalized Log Visibility | Cortex XDR Alert Visibility | Vendor Alert Visibility |
| -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------- | ------------------------- | --------------------------- | ----------------------- |
| [AWS](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-cloud-assets/ingest-cloud-assets-from-aws.md) | — | N/A | N/A | N/A |
| [Google Cloud Platform](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-cloud-assets/ingest-cloud-assets-from-google-cloud-platform.md) | — | N/A | N/A | N/A |
| [Microsoft Azure](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-cloud-assets/ingest-cloud-assets-from-microsoft-azure.md) | — | N/A | N/A | N/A |
Custom external sources
| Vendor and Device Type | Raw Data Visibility | Normalized Log Visibility | Cortex XDR Alert Visibility | Vendor Alert Visibility |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [Any Vendor Sending CEF, LEEF, CISCO, CORELIGHT, or RAW formatted Syslog](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-logs-from-a-syslog-receiver.md)\* |
Raw data is searchable in XQL Search.
| — |
Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs.
Note
While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.
To enable Cortex XDR to display alerts from other vendors, you must map your alert fields to the Cortex XDR field format (see Ingest external alerts).
|
| [Any vendor CSV files on a shared Windows directory](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-csv-files-as-datasets.md)\* |
Raw data is searchable in XQL Search.
| — |
Cortex XDR can raise Cortex XDR alerts (Correlation Rules only) when relevant from logs.
| — |
| [Any vendor logs stored in a database](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-database-data-as-datasets.md)\* |
Raw data is searchable in XQL Search.
| — |
Cortex XDR can raise Cortex XDR alerts (Correlation Rules only) when relevant from logs.
| — |
| [Any vendor logs stored in files on a network share](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-logs-in-a-network-share-as-datasets.md)\* |
Raw data is searchable in XQL Search.
| — |
Cortex XDR can raise Cortex XDR alerts (Correlation Rules only) when relevant from logs.
| — |
| [Any vendor logs from a third party source over FTP, FTPS, or SFTP](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-ftp-files-as-datasets.md)\* |
Raw data is searchable in XQL Search.
| — |
Cortex XDR can raise Cortex XDR alerts (Correlation Rules only) when relevant from logs.
| — |
| [Any vendor sending NetFlow flow records](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-netflow-flow-records-as-datasets.md)\* |
Raw data is searchable in XQL Search.
|
NetFlow events are stitched with the Agent’s EDR data and other Network products to a Session Story, and are searchable in the Query Builder and in XQL.
|
Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs.
Note
While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.
Raw data is searchable in XQL Search.
| — |
Cortex XDR can raise Cortex XDR alerts (Correlation Rules only) when relevant from logs.
|
To enable Cortex XDR to display alerts from other vendors, you must map your alert fields to the Cortex XDR field format (see Ingest external alerts).
|
| [Apache Kafka](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-apache-kafka-events-as-datasets.md)\* |
Raw data is searchable in XQL Search.
| — |
Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs.
Note
While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.
Raw data is searchable in XQL Search.
| — |
Cortex XDR can raise Cortex XDR alerts (Correlation Rules only) when relevant from logs.
| — |
| [Box](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-logs-and-data-from-box.md) |
Raw data is searchable in XQL Search.
|
Selected Box audit event logs are normalized into stories and are searchable in the Query Builder and in XQL.
|
Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs.
Note
While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.
Raw data is searchable in XQL Search.
|
Selected Box audit event logs are normalized into stories and are searchable in the Query Builder and in XQL.
|
Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs.
Note
While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.
Raw data is searchable in XQL Search.
| — |
Cortex XDR can raise Cortex XDR alerts (Correlation Rules only) when relevant from logs.
| — |
| [Forcepoint DLP](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-logs-from-forcepoint-dlp.md)\* |
Raw data is searchable in XQL Search.
| — |
Cortex XDR can raise Cortex XDR alerts (Correlation Rules only) when relevant from logs.
| — |
| [IoT Security](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/palo-alto-networks-integrations/ingest-alerts-and-assets-from-pan-iot-security.md) |
Raw data is searchable in XQL Search.
|
Cortex XDR uses IoT Security information to improve analytics detection and assets management information.
|
Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs.
Note
While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.
Raw data is searchable in XQL Search.
|
Detection events are stitched with other Palo Alto Networks product logs to stories, and are searchable in the Query Builder and in XQL.
|
Cortex XDR can raise Cortex XDR alerts (Analytics, IOC, BIOC, and Correlation Rules) when relevant from logs.
Note
While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC and BIOC alerts are only raised on normalized logs.
Alerts from NGFW are raised throughout Cortex XDR when relevant.
|
| [Workday](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-report-data-from-workday.md) |
Raw data is searchable in XQL Search.
| — |
Cortex XDRCortex XDR alerts (Correlation Rules only) when relevant from logs.
| — |
| Any vendor sending alerts\* | — | — | — |
Alerts are surfaced throughout Cortex XDR when relevant. To enable Cortex XDR to display your alerts, you must map your alert fields to the Cortex XDR field format (see Ingest external alerts).
|
**Datasets created from ingesting data**
When ingesting data from an external source, Cortex XDR creates a dataset that you can query using Cortex Query Language (XQL). Datasets created in this way use the following naming convention.
```programlisting
__raw
```
For example: cisco\_asa\_raw
The datatypes used for the fields in an imported dataset are automatically assigned based on the input content. Fields can have a datatype of `string`, `int`, `float`, `time`, or `boolean`. All other fields are ingested as a JSON object.
For CEF type files, when extension values are quoted, the CEF parser automatically removes the quotes from the values. In addition, files containing invalid UTF-8 are parsed under XQL mapping field `_invalid_utf8`.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/visibility-of-logs-and-alerts-from-external-sources.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.