topic Event Logs That Are being Gathered With Cortex XDR - Windows in Cortex XDR Discussions

Event Logs That Are being Gathered With Cortex XDR - Windows

mkuhelj — Fri, 22 Sep 2023 06:12:27 GMT

Hi Everyone,

I was doing some research on Event IDs that are being gathered by Cortex XDR and I came to the conclusion that the Event ID needs to be enabled on the Windows first so XDR is being able to gather them.
XDR probably does not overrule the local audit log settings on the server for example.

Am I correct or am I missing something?

Thank you!

Re: Event Logs That Are being Gathered With Cortex XDR - Windows

creddy — Fri, 22 Sep 2023 09:24:33 GMT

Hi @mkuhelj
Thanks for writing to live community.

Yes, you are right.
First the event has to be generated and present on the machine in order for XDR Agent to be able to collect it and forward to XDR cloud servers.
For more details on what data XDR collect, you may refer Endpoint Data Collection
I hope that answers your question.

Please mark this as answer if you found it helpful.

Thank you!