Forward notifications to Amazon S3 - Configure an Amazon S3 external application in Cortex XDR to forward cases and issues to an S3 bucket. - Administrator Guide - Cortex XSIAM - Cortex XDR - Cortex - Security Operations

Log in to your AWS Management Console.

Navigate to S3 and click Create bucket.

Enter a unique bucket name and select the AWS Region. Note the region, as you will need it later.

Verify Block all public access is turned on for security.

In the Cortex Gateway, go to Permission Management → Egress Configurations → Path.

Select the account name and tenant.

In the Flow field, select External Storage: AWS S3.

Enter the exact <bucket_name>. For example, my-example-bucket. Do not include subfolders.

Add the configuration.

In Cortex XDR, go to Settings → Configurations → Integrations → External Applications → Add Application and select Amazon S3.

Enter the S3 URI.

Click Verify. If egress has not been configured in the Cortex Gateway, verification will fail and a message will display that the endpoint does not match any approved routes.

After verification is successful, an authorized party ID is generated. Copy this ID for your AWS configuration.

Leave this page open to complete the application configuration after configuring the IAM role and permissions in AWS.

In AWS, go to IAM → Roles → Create role, select Custom trust policy, and enter the Trusted Entity JSON, replacing the sub condition with your Authorized party ID. The following is an example:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "accounts.google.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "accounts.google.com:sub": "<Your_Authorized_Party_ID>"
        }
      }
    }
  ]
}

Create and attach a policy granting permissions.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Statement1",
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::<your-bucket-name>/*"
      ]
    }
  ]
}

Go back to Cortex XDR and enter the instance name and an optional description.

Select IAM Role as the connection method and paste the Role ARN (Amazon Resource Name) from the role you created.

Enter the AWS region. The region you select must exactly match the bucket's region in AWS.

Select the file rollup time to collect data (cases or issues) before sending. The default is one hour. This is the maximum duration the system collects data before writing to a new file in Amazon S3.

Click Test to verify Cortex XDR can write a test object, then click Connect.