> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/forward-logs-and-data-from-cortex-xsiam-to-external-services/set-up-email-notifications-for-tenant-updates.md). # Set up email notifications for tenant updates Your Cortex tenant generates Management Audit Logs throughout the tenant update lifecycle. This includes version upgrades and hotfixes, covering both the pending (before) and completed (after) phases of a scheduled update. Using log forwarding, you can automatically receive an email whenever one of these events occurs, ensuring your team is notified the moment a change is scheduled or completed on your tenant. {% hint style="warning" %} **Prerequisites** Ensure you have the following: * Admin privileges on the tenant. * The email distribution list that will receive the notifications. * Your tenant name (for example., acme-corp.us) to include in the email subject for easy identification. {% endhint %} ### How audit events are structured Every forwarding rule is built by matching key fields from the Management Audit Log: | Field | What it tells you | Values to filter on | | ----------- | ------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------- | | Type | The domain that produced the event. | Tenant Management | | Subtype | The exact phase of the lifecycle. | Upgrade Pending, Upgrade Completed, Hotfix Pending, Hotfix Completed | | Description | Human-readable summary of the event. | Contains the word downtime when downtime is involved. This enables you to build targeted rules that run only when downtime is expected. | ### How to set up email notifications for tenant updates 1. Go to **Settings** → **Configurations** → **General** → **Notifications** → **+ Add Forwarding Configuration**. 1. In the **Define** step, set the forwarding configuration details. 2. Enter a name for the configuration. 3. For **Log Type**, select **Management Audit Logs**. 4. (Optional) Enter a description of the forwarding configuration. 5. Click **Next**. 2. In the **Scope** step, filter which issues, cases, or logs you want included in a notification and then click **Next**.\ For example, for a filter set to Severity = Medium, Category = Configuration, Cortex XSIAM sends the issues or events matching this filter as a notification. 3. In the **Forward Destination** step, define the destination details. 1. Select the **Notification Timezone**. 2. Under the **Add Application** dropdown, enable one or more integrations. 3. Enable **Email**. 4. Enter the recipients in the **Email distribution list** field. 5. Set the **Grouping timeframe** to **1 minute**.\ A one minute timeframe ensures pre-upgrade and pre-hotfix warnings arrive in time to be actionable without unnecessary delays. 6. Clear the **Use Auto Generated Subject** checkbox.\ Writing a custom subject that includes your tenant name and the event type (for example, \ tenant - Pre-upgrade warning) enables recipients to instantly identify the affected tenant. 7. Enter your custom subject and add the **Filter / Conditions** for your specific use case from the use case configurations table below. 4. Click **Create**. ### Use case configurations The following table provides subject lines and filter conditions for your notification needs. For all rules below, the **Entity** condition must be set to **Tenant Management**. | Use case | When the email is sent | Email recipients | Custom email subject | Additional filter conditions | | ----------------------------- | ---------------------------------------------------- | ------------------------------------------------------------------------------------ | ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | All upgrade and hotfix events | Any upgrade/hotfix event occurs. | Compliance and audit teams needing a complete record. This is the simplest approach. | \ tenant - Upgrade/Hotfix audit log | (None) | | Pre-upgrade warning | An upgrade is about to begin (\~10-min warning). | Operations teams needing to prepare. | \ tenant - Pre-upgrade warning | Subtype contains Upgrade Pending | | Post-upgrade completion | An upgrade has successfully completed. | Anyone tracking version changes. | \ tenant - Upgrade completed | Subtype contains Upgrade Completed | | Pre-hotfix warning | A hotfix is about to be deployed (\~10-min warning). | Operations teams needing to prepare. | \ tenant - Pre-hotfix warning | Subtype contains Hotfix Pending | | Post-hotfix completion | A hotfix has been successfully deployed. | Anyone tracking deployments. | \ tenant - Hotfix completed | Subtype contains Hotfix Completed | | Any event with downtime | An upgrade or hotfix requires downtime. | On-call and SRE teams tracking service interruptions. | \ tenant - Upgrade/Hotfix with downtime |

Description contains downtime

Example configurations:

  • description contains downtime
  • type = Tenant Management
  • subtype contains upgrade

OR

  • description contains downtime
  • type = Tenant Manage
| ### Manage and test your rules * View all rules: Go to **Settings** → **Configurations** → **General** → **Notifications**. Each forwarding configuration is listed with its log type, destination, and status. * Edit or pause notifications: Open any rule to change recipients, adjust filters, or toggle it on/off. * Verify the notification is sent: The next time an upgrade or hotfix occurs, confirm the expected email arrives. You can also check the event in **Settings** → **Management Audit Logs**. * Audit log retention: All audit events are retained for 365 days, enabling you to review historical events in the **Management Audit Logs** table even if you miss an email. ### Frequently asked questions
Should I create one general rule or several specific ones? If you need a complete record, the use case for all upgrade and hotfix events is the simplest approach. Create individual pre-event and post-event rules only if you need to route specific phases to different teams (for example, warnings to on-call engineers or completions to compliance).
Can I forward these logs to other destinations? Yes. You can route Management Audit Logs to a Syslog receiver by changing the destination to Syslog during setup. The filter configurations remain exactly the same.
Why does the time in the email differ from the tenant UI? The tenant UI displays times based on your tenant **timezone** server setting. Forwarded emails use UTC to provide an unambiguous timestamp for all recipients.

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/forward-logs-and-data-from-cortex-xsiam-to-external-services/set-up-email-notifications-for-tenant-updates.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.