Forcepoint DLP

Configure on-premises data collection for Cortex XDR.

You can configure collecting Corelight Zeek logs using a Broker VM Syslog Collector applet or with a content pack integration:

Forcepoint DLP vendor	Description
Syslog Collector applet overview	If you use Forcepoint DLP to prevent data loss over endpoint channels, you can forward logs to Cortex XSIAM using the Broker VM Syslog Collector applet in a CEF or LEEF format.