# Cortex XSOAR Management Logs

Collects management audit logs from Palo Alto Cortex XSOAR security orchestration platform.

## Details

This input retrieves audit management logs from the Cortex XSOAR API, providing visibility into user actions, system events, and configuration changes within your XSOAR instance. Key features include:

- Incremental sync with state management
- Tracks user activities, authentication events, and configuration changes
- Captures incident management, playbook execution, and integration activities

## Prerequisites

1. A Cortex XSOAR instance with API access
2. API Key and API Key ID generated from your XSOAR instance
3. Domain name (FQDN) of your Cortex XSOAR instance

## Setup Instructions

1. Log in to your Cortex XSOAR instance
2. Generate an API Key following [Palo Alto Networks' API documentation](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR-8-API/Create-a-new-API-key)
3. Note down both the API Key and its corresponding [API Key ID](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR-8-API/Get-your-Cortex-XSOAR-API-key-ID)
4. Identify your instance's fully qualified [domain name](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR-8-API/Get-your-FQDN) (FQDN)
   - Format: `https://{YOUR-DOMAIN}/xsoar/public/v1/`
5. Configure the input using the API Key, API Key ID, and domain name

## Related Articles

- [Cortex XSOAR API Reference](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR-8-API/Cortex-XSOAR-8-overview)
- [Audit Logs Documentation](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR-8-API/Get-audit-management-log)

## Configuration

### Settings

| Field               | Description                                                                                                                                              | Type   | Required |
| ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ | -------- |
| api_key_id          | The API Key ID for authentication                                                                                                                       | string | Yes      |
| domain_name         | The domain name of your Cortex XSOAR instance (FQDN)                                                                                                     | string | Yes      |
| backfill_start_time | The date to start fetching data from. If not specified, a full sync is fetched on the first sync. All syncs after that will be incremental. | string | The date to start fetching data from. If not specified, no past records will be fetched. |
| API Rate Limit | Optional limit on the connector's outbound request rate to the source API. Leave blank to use the connector's default behavior. See [API Rate Limiting](../../../guides/rate-limiting) for the field format, limits, and how to choose a value. | object | No |

### Secrets

| Field   | Description                  | Type   | Required |
| ------- | ---------------------------- | ------ | -------- |
| api_key | The API Key for authentication | string | Yes      |

## Note on Collection Behavior

The input follows an incremental collection pattern:
- First run: Collects all available audit logs from the specified backfill start time (or all available logs if not specified)
- Subsequent runs: Collects only new audit logs since the last successful run
- Implements state management to track the last collection timestamp
- Automatically handles pagination for large result sets

## Troubleshooting

Common issues and their solutions:

1. Authentication failures
   - Verify API Key and API Key ID are correct and match
   - Ensure the API key has not expired
   - Check that the API key has appropriate permissions for audit log access
   - Confirm the API credentials were generated for the correct XSOAR instance

2. Connection issues
   - Verify the domain name (FQDN) is correct and accessible
   - Ensure the domain name includes the full path: `https://{YOUR-DOMAIN}/xsoar/public/v1/`
   - Check network connectivity and firewall rules
   - Verify proper SSL/TLS configuration

3. Missing data
   - Check the backfill_start_time configuration
   - Verify that audit logging is enabled in your XSOAR instance
   - Ensure the API user has permissions to access audit logs

## Sample Record

```json
{
  "AUDIT_ID": 742856,
  "AUDIT_OWNER_NAME": "John Smith",
  "AUDIT_OWNER_EMAIL": "john.smith@example.com",
  "AUDIT_ASSET_JSON": "{}",
  "AUDIT_ASSET_NAMES": "asset-server-01",
  "AUDIT_HOSTNAME": "xsoar-server-01",
  "AUDIT_RESULT": "SUCCESS",
  "AUDIT_REASON": "",
  "AUDIT_DESCRIPTION": "User logged in successfully",
  "AUDIT_ENTITY": "AUTH",
  "AUDIT_ENTITY_SUBTYPE": "Login",
  "AUDIT_SESSION_ID": 856234719284,
  "AUDIT_CASE_ID": 394857261,
  "AUDIT_INSERT_TIME": 1744456299142,
  "AUDIT_SEVERITY": "SEV_010_INFORMATIONAL",
  "AUDIT_LINK": null,
  "AUDIT_SOURCE_IP": "203.0.113.45",
  "AUDIT_USER_AGENT": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36",
  "AUDIT_USER_ROLES": [
    "Security Analyst"
  ],
  "AUDIT_ADDITIONAL_INFORMATION": {
    "endpoint_names": [
      "WIN-server01"
    ],
    "endpoint_count": 5
  },
  "AUDIT_OBJECT_ID": null
}
```

## Sync frequency

By default this input polls approximately every 10 seconds, with each sync beginning after the previous one completes. A cron schedule configured on the pipeline overrides this cadence. See [Input Sync Frequency](../../guides/sync-frequency) for details.