topic Security Channel Subscription Errors in Cortex XDR Discussions

Security Channel Subscription Errors

P.Kanagasingham — Thu, 27 Feb 2025 16:14:59 GMT

Team,

While trying to collect logs from windows, one channel that is consistently resulting in errors is security channel. Systems and Applications work just fine eliminating any possibility connectivity or authentication issues. It is the security channel that is causing issues and not sending logs to XDR. I know it is too broad a question. Given that it is only security logs, I thought others must have experienced this. Any help is appreciated.

Re: Security Channel Subscription Errors

aspatil — Fri, 28 Feb 2025 04:37:13 GMT

Hello @P.Kanagasingham ,

Thanks for reaching out on LiveCommunity!

How are you collecting WEC logs in Cortex XDR. Is it Brokervm, XDR collector or using Endpoint data collection?

Re: Security Channel Subscription Errors

P.Kanagasingham — Fri, 28 Feb 2025 14:05:06 GMT

It is WEC logs in Cortex XDR using brokerVM.

Re: Security Channel Subscription Errors

P.Kanagasingham — Sat, 01 Mar 2025 18:21:38 GMT

It is WEC logs in Cortex XDR using brokerVM.

Re: Security Channel Subscription Errors

aspatil — Mon, 03 Mar 2025 05:52:44 GMT

Hello @P.Kanagasingham ,

It seems this is a bug which is going to be fix in April 3.14 release. However, as a best practice, I will recommend to open a TAC case to get the confirmation.

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

Regards,

Ashutosh