> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr/insights-and-tips-cortex-xdr/data-and-platform-administration/data-ingestion-methods.md). # Data ingestion methods Learn how Cortex XDR ingests endpoint, on-premises, cloud, identity, and third-party data using collectors, integrations, and Broker VMs. Cortex XDR is a cloud-delivered (SaaS) platform. The management console, analytics, and storage run in Palo Alto Networks' cloud. You deploy lightweight components on-premises only to collect data and run actions inside your network. ### Ingestion methods | Method | Use it for | Examples | | --------------------------------------------- | -------------------------------------------------- | ---------------------------------------------------------------------------------------- | | **Cortex XDR agent** | Endpoint telemetry and protection | Windows, macOS, Linux, and mobile endpoints | | **Broker VM** (on-premises virtual appliance) | Sources that can't send directly to the cloud | Syslog (CEF, LEEF, and raw), Windows Event Collector, database, CSV, FTP, Kafka, NetFlow | | **XDR Collector** | Log collection from servers without the full agent | Windows event logs and Linux log files | | **HTTP Log Collector** | Sources that push logs over HTTPS | Raw, JSON, CEF, or LEEF | | **Native cloud and API collectors** | SaaS and cloud services | Microsoft 365, Okta, Microsoft Entra ID, Zscaler, Google Workspace, and more | | **Cloud storage and streaming** | Bulk cloud logs | Amazon S3, Azure Event Hub, Google Cloud Pub/Sub | | **Marketplace integrations** | Alerts, enrichment, and two-way actions | EDR, email security, vulnerability management, ITSM | See [Broker VM data collector applets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-data-collector-applets), [XDR Collectors](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/xdr-collectors), [HTTP Log Collector](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/http-log-collector), [Amazon S3](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/amazon/amazon-s3), [Azure Event Hub](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/microsoft/azure-event-hub), and [Ingest logs and data from a GCP Pub/Sub](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/google/google-cloud-platform/ingest-logs-and-data-from-a-gcp-pub-sub). ### On-premises components | Component | Purpose | Required? | | ---------------- | -------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------ | | Cortex XDR agent | Endpoint protection and telemetry | For endpoint coverage | | Broker VM | Local log collection and secure tunnel to the tenant | When you collect on-premises logs such as syslog | | XDR Collector | Agent-based log forwarding from servers | Optional alternative to the Broker VM for host logs | | Engine | Runs integrations and playbook actions inside your network, such as disabling a user in on-premises Active Directory | Only when automations need to reach internal resources | ### Cloud coverage Onboard AWS, Microsoft Azure, Google Cloud, Oracle Cloud Infrastructure, and Alibaba Cloud for audit logs, flow logs, and asset discovery. See [Cloud service provider (CSP) onboarding](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding). ### Identity providers Ingest authentication and directory data from providers such as Microsoft Entra ID, Okta, Ping Identity, and on-premises Active Directory. Identity data powers identity analytics and user behavior detections. See [Okta](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/okta) and [Ping Identity](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/ping-identity). ### Third-party sources For per-vendor ingestion steps, browse the vendor-specific data sources in the Cortex XDR documentation. Many sources can be onboarded in minutes once you have API credentials. Sources that send syslog through a Broker VM need the applet configured first. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr/insights-and-tips-cortex-xdr/data-and-platform-administration/data-ingestion-methods.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.