A company has deployed the following • VM-300 firewalls in AWS • endpoint protection with the Traps Management Service • a Panorama M-200 for managing its VM-Series firewalls • PA-5220s for its internet perimeter, • Prisma SaaS for SaaS security. Which two products can send logs to the Cortex Data Lake? (Choose two).

Cortex Data Lake (CDL) is designed to ingest logs from various Palo Alto Networks security products. Next-Generation Firewalls, including the VM-300, are a primary log source, sending detailed traffic, threat, and other logs. The Traps Management Service, the predecessor to Cortex XDR, is the endpoint security solution that sends critical endpoint activity and security event logs to CDL. Both are considered foundational, native log sources that stream data directly to the data lake for centralized storage and analysis.

A. Prisma SaaS: While Prisma SaaS integrates with and utilizes Cortex Data Lake, it is categorized as an application that consumes data from the lake, rather than a primary, native log-streaming source like a firewall or endpoint agent.
D. Panorama M-200 appliance: Panorama is a centralized management system that can forward logs from managed firewalls to CDL. It is primarily a log forwarder and manager, not a primary source of security event logs itself.

1. Palo Alto Networks. (2023). Cortex Data Lake Administrator's Guide. "Log Sources that Natively Stream to Cortex Data Lake". This section explicitly lists Next-Generation Firewalls (including VM-Series) and Traps management service as native log sources.

2. Palo Alto Networks. (2023). PAN-OS® Administrator's Guide 10.2. "Log Forwarding Overview". This document describes how Panorama can be configured to forward logs from firewalls, distinguishing its role from the firewalls that generate the logs.