> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xdr-3-api/cortex-xdr-3.x-apis/syslog-servers.md).

# Syslog Servers

APIs for managing syslog servers

## Create a syslog integration

> Create a new syslog integration.\
> \
> You must have \*\*View/Edit Alert Notification\*\* permissions to run this endpoint.

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Syslog servers","description":"APIs for managing syslog servers"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/integrations/syslog/create":{"post":{"summary":"Create a syslog integration","tags":["Syslog servers"],"parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"syslog_integration_id":{"type":"integer"},"name":{"type":"string"}}}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Payment Required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"operationId":"post-public_api-v1-integrations-syslog-create","requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.","properties":{"name":{"type":"string","description":"Unique name for the syslog server integration."},"address":{"type":"string","description":"IP address or fully qualified domain name (FQDN) of the syslog server."},"port":{"type":"integer","description":"The port number on which the syslog server listens for messages."},"protocol":{"description":"Select a method of communication:\n- TCP: No validation is made on the connection with the syslog server. However, if an error occurred with the domain used to make the connection, the Test connection will fail.\n- UDP: No error checking, error correction, or acknowledgment. No validation is done for the connection or when sending data.\n- TLS:  Cortex validates the syslog server certificate and uses the certificate signature and public key to encrypt the data sent over the connection.","enum":["TCP","UDP","TLS"]},"facility":{"type":"string","description":"Choose one of the syslog standard values. The value maps to how your syslog server uses the facility field to manage messages. For details on the facility field, see [RFC 5424](https://datatracker.ietf.org/doc/html/rfc5424)."},"security_info":{"type":"object","description":"The `security_info` parameters are necessary only when `protocol` is `TLS`.","properties":{"certificate_name":{"type":"string","description":"When using TLS for communication between Cortex and the syslog server, Cortex validates that the syslog receiver has a certificate. Specify the certificate name here."},"ignore_cert_errors":{"type":"boolean","description":"Whether to ignore certificate errors. For security reasons, this is not recommended. If you set this to `true`, logs will be forwarded even if the certificate contains errors."},"certificate_content":{"type":"string","format":"binary","description":"Binary string of the certificate."}}}}}}}}}},"description":"Create a new syslog integration.\n\nYou must have **View/Edit Alert Notification** permissions to run this endpoint."}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get all or filtered syslog servers

> Get a complete or filtered list of syslog servers.\
> \
> You must have \*\*View Alert Notification\*\* permissions to run this endpoint.

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Syslog servers","description":"APIs for managing syslog servers"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/integrations/syslog/get":{"post":{"summary":"Get all or filtered syslog servers","tags":["Syslog servers"],"parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"objects_count":{"type":"integer","description":"The number of syslog servers that are returned."},"objects":{"type":"array","description":"The syslog server details.","items":{"type":"object","properties":{"SYSLOG_INTEGRATION_ID":{"type":"integer"},"SYSLOG_INTEGRATION_NAME":{"type":"string","description":"Syslog server integration name."},"SYSLOG_INTEGRATION_ADDRESS":{"type":"string","description":"IP address or fully qualified domain name (FQDN) of the syslog server."},"SYSLOG_INTEGRATION_PORT":{"type":"integer","description":"The port number on which the syslog server listens for messages."},"SYSLOG_INTEGRATION_PROTOCOL":{"type":"string","description":"The communication protocol:\n- TCP: No validation is made on the connection with the syslog server. However, if an error occurred with the domain used to make the connection, the Test connection will fail.\n- UDP: No error checking, error correction, or acknowledgment. No validation is done for the connection or when sending data.\n- TLS:  Cortex validates the syslog server certificate and uses the certificate signature and public key to encrypt the data sent over the connection."},"FACILITY":{"type":"string"},"SYSLOG_INTEGRATION_STATUS":{"type":"string"},"SYSLOG_INTEGRATION_ERROR":{"nullable":true},"SYSLOG_INTEGRATION_CERTIFICATE_NAME":{"nullable":true},"SYSLOG_INTEGRATION_IGNORE_CERTIFICATE_ERROR":{"type":"string"}}}}}}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Payment Required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"operationId":"post-public_api-v1-integrations-syslog-get","description":"Get a complete or filtered list of syslog servers.\n\nYou must have **View Alert Notification** permissions to run this endpoint.","requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields. An empty dictionary returns all results.","properties":{"filters":{"type":"array","description":"Array of filter fields. Each JSON object must contain a field, operator, and value.","items":{"type":"object","properties":{"field":{"enum":["name","id","address","status"],"description":"String that identifies the syslog server field the filter is matching. Filters are based on the following case-sensitive keywords:\n\n- `name`\n- `id`\n- `address`\n- `status`"},"operator":{"enum":["eq"],"description":"String that identifies the comparison operator you want to use for this filter. Valid operator keywords and corresponding filter fields are:\n- **eq** - used with `name`, `id`, `address`, and `status`"},"value":{"type":"string","description":"Value that the filter must match. The contents of this field will differ depending on the website field that you specified for this filter:\n\n- name - string"}}}}}}}}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Update a syslog integration

> Update the details of the specified syslog integration.\
> \
> You must have \*\*View/Edit Alert Notification\*\* permissions to run this endpoint.

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Syslog servers","description":"APIs for managing syslog servers"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/integrations/syslog/update":{"post":{"summary":"Update a syslog integration","tags":["Syslog servers"],"parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"boolean","description":"Whether the update was successful."}}}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Payment Required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"operationId":"post-public_api-v1-integrations-syslog-update","requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"type":"object","required":["syslog_id"],"description":"A dictionary containing the API request fields.","properties":{"syslog_id":{"type":"string","description":"ID of the syslog server"},"name":{"type":"string","description":"Unique name for the syslog server integration."},"address":{"type":"string","description":"IP address or fully qualified domain name (FQDN) of the syslog server."},"port":{"type":"string","description":"The port number on which the syslog server listens for messages."},"protocol":{"description":"Select a method of communication:\n- `TCP`: No validation is made on the connection with the syslog server. However, if an error occurred with the domain used to make the connection, the Test connection will fail.\n- `UDP`: No error checking, error correction, or acknowledgment. No validation is done for the connection or when sending data.\n- `TLS`:  Cortex validates the syslog server certificate and uses the certificate signature and public key to encrypt the data sent over the connection.","enum":["TCP","UDP","TLS"]},"facility":{"type":"string","description":"Choose one of the syslog standard values. The value maps to how your syslog server uses the facility field to manage messages. For details on the facility field, see [RFC 5424](https://datatracker.ietf.org/doc/html/rfc5424)."},"security_info":{"type":"object","description":"The `security_info` parameters are relevant only when `protocol` is `TLS`.","properties":{"certificate_name":{"type":"string","description":"When using TLS for communication between Cortex and the syslog server, Cortex validates that the syslog receiver has a certificate. Specify the certificate name here."},"ignore_cert_errors":{"type":"boolean","description":"Whether to ignore certificate errors. For security reasons, this is not recommended. If you set this to `true`, logs will be forwarded even if the certificate contains errors."},"certificate_content":{"type":"string","description":"Binary string of the certificate.","format":"binary"}}}}}}}}}},"description":"Update the details of the specified syslog integration.\n\nYou must have **View/Edit Alert Notification** permissions to run this endpoint."}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Delete all or filtered syslog integrations

> Delete all the syslog integrations or the ones who match the filter criteria.\
> \
> You must have \*\*View/Edit Alert Notification\*\* permissions to run this endpoint.

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Syslog servers","description":"APIs for managing syslog servers"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/integrations/syslog/delete":{"post":{"summary":"Delete all or filtered syslog integrations","tags":["Syslog servers"],"parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"responses":{"200":{"description":"OK"},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Payment Required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"operationId":"post-public_api-v1-integrations-syslog-delete","requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields. An empty dictionary deletes all syslog servers.","properties":{"filters":{"type":"array","description":"Array of filter fields. Each JSON object must contain a field, operator, and value.","items":{"type":"object","properties":{"field":{"description":"String that identifies the syslog server field the filter is matching. Filters are based on the following case-sensitive keywords:\n\n- `name`","enum":["name"]},"operator":{"description":"String that identifies the comparison operator you want to use for this filter. Valid operator keywords and corresponding filter fields are:\n- **eq** - used with `name`","enum":["eq"]},"value":{"type":"string","description":"Value that the filter must match. The contents of this field will differ depending on the website field that you specified for this filter:\n\n- name - string"}}}}}}}}}}},"description":"Delete all the syslog integrations or the ones who match the filter criteria.\n\nYou must have **View/Edit Alert Notification** permissions to run this endpoint."}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Test syslog integration

> Tests a syslog integration's validity.\
> \
> You must have \*\*View Alert Notification\*\* permissions to run this endpoint.

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Syslog servers","description":"APIs for managing syslog servers"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/integrations/syslog/test":{"post":{"summary":"Test syslog integration","tags":["Syslog servers"],"parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"responses":{"200":{"description":"OK"},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Payment Required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"operationId":"post-public_api-v1-integrations-syslog-test","description":"Tests a syslog integration's validity.\n\nYou must have **View Alert Notification** permissions to run this endpoint.","requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.","properties":{"syslog_id":{"type":"string","description":"If you include the `syslog_id` of an existing syslog integration, it will try to load the certificate data from the database to test the existing syslog integration."},"name":{"type":"string","description":"Unique name for the syslog server integration."},"address":{"type":"string","description":"IP address or fully qualified domain name (FQDN) of the syslog server."},"port":{"type":"string","description":"The port number on which the syslog server listens for messages."},"protocol":{"description":"Select a method of communication:\n- `TCP`: No validation is made on the connection with the syslog server. However, if an error occurred with the domain used to make the connection, the Test connection will fail.\n- `UDP`: No error checking, error correction, or acknowledgment. No validation is done for the connection or when sending data.\n- `TLS`:  Cortex validates the syslog server certificate and uses the certificate signature and public key to encrypt the data sent over the connection.","enum":["TCP","UDP","TLS"]},"facility":{"type":"string","description":"Choose one of the syslog standard values. The value maps to how your syslog server uses the facility field to manage messages. For details on the facility field, see [RFC 5424](https://datatracker.ietf.org/doc/html/rfc5424)."},"security_info":{"type":"object","description":"The `security_info` parameters are relevant only when `protocol` is `TLS`.","properties":{"certificate_name":{"type":"string","description":"When using TLS for communication between Cortex and the syslog server, Cortex validates that the syslog receiver has a certificate. Specify the certificate name here."},"ignore_cert_errors":{"type":"boolean","description":"Whether to ignore certificate errors. For security reasons, this is not recommended. If you set this to `true`, logs will be forwarded even if the certificate contains errors."},"certificate_content":{"type":"string","format":"binary","description":"Binary string of the certificate."}}}}}}}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xdr-3-api/cortex-xdr-3.x-apis/syslog-servers.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.