When Cortex XDR alerts and audit logs are forwarded to an external data source, notifications are sent in the following formats. If you prefer Cortex XDR to forward logs in legacy format, you can choose the legacy option in your log forwarding configuration.