topic Re: Do we need to install XDR Collectors in our servers to Collect Windows Events ? in Cortex XDR Discussions

Do we need to install XDR Collectors in our servers to Collect Windows Events ?

Ariq_Aziz — Thu, 12 Jan 2023 04:14:36 GMT

We are using cortex XDR and planning to deploy the XSIAM. We are working on the deployment. While reading the below document for collecting Windows events,

XDR Collector Machine Requirements and Supported Operating Systems • Cortex XDR Pro Administrator Guide • Reader • Palo Alto Networks documentation portal

My question is,

We have the broker VM configured.

All the Windows Servers are running XDR agents 7.9

As per document, the solution requires to install XDR collector in the servers. So, As we are running XDR agents, so do we need to install XDR collectors in the server which will reside with XDR agents parallelly and will collect the Windows Events ?

Re: Do we need to install XDR Collectors in our servers to Collect Windows Events ?

mavraham — Thu, 12 Jan 2023 17:24:52 GMT

Hi @Ariq_Aziz

Thank you for writing to live community.

Please allow me to explain the difference between using BrokerVM and XDR Collectors to collect windows events:

Both BrokerVM and the XDR Collector are able to collect any kind of windows event log.

The main difference between the two would be that BrokerVM needs to be configured on the domain controller level, establishes a remote connection and allows all Windows domain members to push their logs into BrokerVM. Whereas, the XDR Collector is an agent reading directly from the filesystem and enables you to collect file and log data using the Elasticsearch Filebeat default configuration file.

In your instance, if you are already using BrokerVM to collect Windows event longs (assuming you tested and made sure it works) installing the XDR Collector is optional.

Re: Do we need to install XDR Collectors in our servers to Collect Windows Events ?

Ariq_Aziz — Sat, 14 Jan 2023 22:02:43 GMT

HI Mavraham

Thanks a lot for the reply. It's really helpful. 🙂 it seems like we dont need Collector as we have the Broker VM. Thanks again.

Re: Do we need to install XDR Collectors in our servers to Collect Windows Events ?

JahidAliyev — Tue, 27 Feb 2024 11:24:55 GMT

Hi @mavraham, If we use XDR collector to colelct WEC logs, do we need to install that agent on all endpoints?

Re: Do we need to install XDR Collectors in our servers to Collect Windows Events ?

SeanDeHarris — Thu, 19 Jun 2025 05:50:19 GMT

Hi @mavraham

Does the XDR collector support Event Forwarding funtion?
Or we need to install the XDRC on each endpoints/servers/DC to collect the Windows event?

Thanks