Powershell Protected Script Block logging

[RFeyertag]

Hello dear community, 

does Cortex XDR Pro handle also the protected event logging?

https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_wi...

BR

Rob

[mavraham]

Hi @RFeyertag, thanks for writing to Live Community.

When you say can Cortex handle protected event logging, do you mean can it ingest the encrypted logs?

[RFeyertag]

Hello @mavraham ,

yes I mean ingesting the encryted logs through the Cortex XDR Pro Agent.

BR

Rob

[mavraham · Accepted solution]

Hi @RFeyertag,

I've checked with some of my colleagues. While the Cortex XDR agent can ingest powershell script-blok logs, it will not be able to decrypt them.

[RFeyertag]

Hey @mavraham! 

Thank you very much for this clarification! Have nice day!

BR

Rob