Ingest logs from Forcepoint DLP - Extend Cortex XDR visibility into logs from Forcepoint DLP. - Administrator Guide - Cortex XDR - Cortex - Security Operations

If you use Forcepoint DLP to prevent data loss over endpoint channels, you can take advantage of Cortex XDR investigation and detection capabilities by forwarding your logs to Cortex XDR. This enables Cortex XDR to help you expand visibility into data violation by users and hosts in the organization, correlate and detect DLP incidents, and query Forcepoint DLP logs using XQL Search.

When Cortex XDR starts to receive logs, Cortex XDR can analyze your logs in XQL Search and you can create new Correlation Rules.

To integrate your logs, you first need to set up an applet in a Broker VM within your network to act as a Syslog Collector. You then configure forwarding on your log devices to send logs to the Syslog Collector in a CEF or LEEF format.

Configure Forcepoint DLP collection in Cortex XDR.