> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/gateway-guide/egress-configurations.md). # Egress configurations Configure, approve, and manage tenant egress paths for external services in Cortex Gateway. The outgoing communication between tenants and external services is defined either by Cortex or by the user. Using the **Egress Configurations** feature in the Cortex Gateway, the user can define, manage, and approve a tenant's outgoing communication flow, providing greater control over outgoing traffic. For detailed information on which flows are available for you to create a path for your tenant, see [Supported egress flows and paths](#UUID-fa0da114-2f2c-ab76-a5a5-2a75c5e2cac6_bridgehead-idm234770021606889). {% hint style="warning" %} Only Account Admin and Instance Admin can submit a request on behalf of a user. Only users with these roles can view the **Egress Configurations** option in the Gateway. The Account Admin can view all the tenants from the account where requests have been submitted, and the Instance Admin can view all the requests that have been submitted for their tenant. {% endhint %} ### Egress configuration options in Cortex Gateway In Cortex Gateway, you can use the **Egress Configurations** for the following options: * You can create a path. * You can remove a request that's been approved. * You can filter by flow. ### Egress configuration parameters After creating a path for your tenant, it is added to the **Egress configurations** table. | Parameter | Description | | --------------- | ------------------------------------------------------------------------------------------------------------------------------- | | Requester |

The user who is creating the path.

Only Account Admin and Instance Admin can submit a request on behalf of a user.

| | Requester Email | The email of the requester. | | Approver | The approver is the Account Admin or Instance Admin. | | Approver Email | The email of the approver. | | Route ID | A unique identifier associated with the path. | | Status |

The status of the egress path, which can be:

| | Date of Request | The date the path was created. | | Updated | The date the path was updated. | ### Supported egress flows and paths The table includes the list of flows that require egress configuration paths before enabling the outgoing traffic. | Flow | Path | Example | | ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------- | | GitHub Server |

\

Enter the domain name or IP address of the GitHub instance.

| `github.com` | | GitHub (Code Scanning) |

\

Enter the owner or organization name of the repository in GitHub.

| `alicesmith` | | GitLab Self Managed |

\

Enter the domain name or IP address of the GitLab instance.

| `gitlab.com` | | GitLab (Code Scanning) |

\

Enter the project name within GitLab to allow access.

| `myproject` | | BitBucket (Code Scanning) |

\

Enter the workspace of your project or repository of the BitBucket application.

| `engineering-team` | | BitBucket Data Center |

\

Enter the server name of where the BitBucket application is running.

| `bitbucket.com` | | Azure DevOps (Code Scanning) |

\

Enter the name of the organization of the Azure Repos instance.

| `myprojectteam` | | TF Run Task Cloud |

\
Enter the organization name of the TF Run Task Cloud account.

| `my-org-name` | | TF Run Task Enterprise | | | | External Storage: S3-compatible |

\

Enter the domain name or IP address of the External Storage: S3-compatible

| `s3browser.com` | | External Storage: AWS S3 |

\

Enter the name of the AWS S3 bucket to allow access.

| `my-example-bucket` | | Snowflake |

\

Enter the host or domain name of the Snowflake account to which you are connecting.

| `mycompany.snowflakecomputing.com` | | SonarQube |

\

Enter the host address or domain of the SonarQube instance to which you are connecting.

| `sonarqube.mycompany.com` | | Webhook |

\

Enter the host name of the Webhook endpoint.

| `webhook.mycompany.com` | | External storage: AWS SQS |

\

Enter the name of the AWS SQS queue.

| `my-example-queue` | | Splunk |

\

Enter the host or domain name of the Splunk instance.

| `splunk.mycompany.com` | ### Submit a new egress path 1. In the Gateway, on the **Egress Configurations** page, choose the TENANT for which to create a new path. 2. Click **Path**: * Select the **Requester** from the list of users. * Select the **Flow** from the list of data service options: * In **Path**, enter the egress configuration path. * Click **Add** to create a new path. The path is added to the **Egress configuration** table, showing the details. ### Remove an egress path Follow the steps to remove a path. 1. In the Gateway, from the **Egress configurations** table, select a path that's been approved. 2. Right-click and select **Remove**. 3. In the **Remove Path** dialog box, click **Continue**. The selected row is greyed out, and the **Status** changes to **Removed**. This is for auditing purposes. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/gateway-guide/egress-configurations.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.