Event Logs That Are being Gathered With Cortex XDR - Windows

[mkuhelj]

Hi Everyone,

I was doing some research on Event IDs that are being gathered by Cortex XDR and I came to the conclusion that the Event ID needs to be enabled on the Windows first so XDR is being able to gather them.
XDR probably does not overrule the local audit log settings on the server for example. 

Am I correct or am I missing something?

Thank you!

[creddy · Accepted solution]

Hi @mkuhelj 
Thanks for writing to live community.

Yes, you are right.
First the event has to be generated and present on the machine in order for XDR Agent to be able to collect it and forward to XDR cloud servers.
For more details on what data XDR collect, you may refer Endpoint Data Collection
I hope that answers your question.

Please mark this as answer if you found it helpful.

Thank you!