Required Windows Event IDs for the best Cortex XDR detection performance

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Required Windows Event IDs for the best Cortex XDR detection performance

L0 Member

Hello, dear Community,


I need a list of Windows event IDs required for BIOC and other Cortex XDR rules to work effectively.

For example, when we performed a Kerberos user enumeration attack using Kerbrute, it was not detected initially. Cortex XDR requires event ID 4768 to be enabled to detect such an attack. After enabling this event ID and testing the attack simulation again, it was successfully detected.

I am now wondering which event IDs are crucial to enable in order to maximize detection opportunities for Cortex XDR. It would be great to get a list of these event IDs.



L5 Sessionator

Hello @agsaqqal 


Thanks for writing to live community.

Yes, you are right.
First the event has to be generated and present on the machine in order for XDR Agent to be able to collect it and forward to XDR cloud servers.
For more details on what data XDR collect, you may refer
I hope that answers your question.


Please mark this as answer if you found it helpful.

Ashutosh Patil
  • 1 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!