topic Re: Monitor and Collect Enhanced Endpoint Data in XDR in Cortex XDR Discussions

Monitor and Collect Enhanced Endpoint Data in XDR

DannyMulheran — Mon, 13 May 2024 00:34:48 GMT

When setting the Agent profile in Cortex XDR, Under the check box when enabling "Monitor and Collect Enhanced Endpoint Data" is the following note:

Note: Before enabling enhanced endpoint data collection make sure your Strata Logging Service storage capacity and quota allocation can support it. Please refer to the Strata Logging Service quota configuration guidelines and storage calculator for more details.

Can anyone tell me how to do this for a Cortex XDR enviroment. I did not find the documention provided any clarity (although I probably missed something!)

Thanks

Danny

Re: Monitor and Collect Enhanced Endpoint Data in XDR

neelrohit — Sun, 26 May 2024 05:58:24 GMT

Hi @DannyMulheran ,

Thank you for writing to live community!

The information provided below refers to the use case for customers who have Cortex XDR Pro Per GB license and Strata Logging service as part of their native data lake licensing. In the old cases, customers would have an option to setup a quota of cortex xdr agent logs and alert logs as a use case.

However, with the advent of new data retention and licensing changes, this does not apply for customers who are not on the native data lake licenses(new/existing customers who have purchased/renewed after December, 2022). Example screenshot below:

However, if you go to the current configurations for Strata Logging Service, this field is not applicable anymore because the Cortex Endpoint storage and Endpoint alerts data storage, though one is still separate and is managed as per the default retention policy or your retention licenses procured.

Hope this helps! Please mark the response as "Accept as Solution" if this helps

Re: Monitor and Collect Enhanced Endpoint Data in XDR

DannyMulheran — Sun, 02 Jun 2024 23:28:19 GMT

Many thanks for taking the time to respond and helping to clarify CDL / Strata logging service.