Cortex XDR Collector Installations query

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Cortex XDR Collector Installations query

L3 Networker

Hi Team,

 

We are planning to install XDR collectors on our DHCP server. At the same time, we already have Cortex XDR agents installed on the DHCP server. Could you please confirm whether we should install both agents or just one of them?

 

Additionally, we are unsure if XDR collectors are solely responsible for log collection or if they also serve a dual purpose of log collection and prevention. We haven't identified any prevention policies in the XDR collectors' settings.

1 REPLY 1

L4 Transporter

Hello @Vinothkumar_SBA 

 

Thanks for reaching out on Live Community!

Deployment of XDR collector depends on what kind of logs you want to collect. If you only want to collect logs from DHCP server as an endpoint from security point of perspective then XDR agent itself collect a good amount of logs. Please refer to below link to see what kind of data XDR agent collects.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Endpoint-Da...

However, if you particularly wants to collect DHCP service logs then you can deploy XDR collector or as an alternate can use elastic search filebeat that can be integrated with XDR tenant directly and push logs. More information on collecting DHCP logs can be found in below link.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Ingest-Logs...

 

XDR collector is only for log collection and cannot provide prevention capabilities.

  • 392 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!