Windows Event Collector

JahidAliyev — Thu, 29 Feb 2024 08:08:51 GMT

Hello,

I want to activate Windows Event Collector on my system. I am looking my documentation. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Activate-the-Windows-Event-Collector?tocId=JKwlSDeDaqpS9R1bOJdayg

What I do not understand is that do I need to do all these steps in domain controller?

Or, I am doing it on one of privileged windows server and configure it as Windows Event Forwarder. Configure DC in a way that it will enforce all computers to send their logs to this Windows Event Forwarder. And, this Windows Event Forwarder will send all logs to my Broker VM.
Is it working like that?

Can anyone explain it to me?

Re: Windows Event Collector

nsinghvirk — Thu, 29 Feb 2024 12:11:01 GMT

Hello @JahidAliyev

Thanks for reaching out on LiveCommunity!

In order for Windows Event Collector to receive logs you need to configure a Windows Event Forwarder which can be a windows server or a domain controller. If you want to collect logs from a number of computers then you need to configure your WEF(server/DC) to collect logs from these sources and then send them to WEC.

There is no such restriction to config DC as WEF.

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

topic Windows Event Collector in Cortex XDR Discussions

Windows Event Collector

Re: Windows Event Collector