Forwarding event to XSIAM

K.Ganiyev — Thu, 26 Dec 2024 11:14:24 GMT

hi , how can i forward special event id to xsiam . For example i want to send 4624 id event log from active directory to cortex xsiam

Re: Forwarding event to XSIAM

afurze — Fri, 27 Dec 2024 15:50:09 GMT

Hi K.Ganiyev,

You will need to configure an appropriate method of obtaining and ingesting the event. For customers who are deploying (or have already deployed) the Cortex XDR agent as a part of their XSIAM deployment, the XDR Agent already collects numerous Windows Event logs and uploads them to the tenant. Customers who have not deployed the XDR Agent, or who want to collect Event IDs not supported by the XDR Agent, you can either configure the WEC applet on the Broker VM, or deploy the XDR Collector and configure it to collect the Event IDs of interest.

topic Re: Forwarding event to XSIAM in Cortex XSIAM Discussions

Forwarding event to XSIAM

Re: Forwarding event to XSIAM