Windows Event Collector

[JahidAliyev]

Hello, 

I want to activate Windows Event Collector on my system. I am looking my documentation. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Activate-th... 

What I do not understand is that do I need to do all these steps in domain controller? 

Or, I am doing it on one of privileged windows server and configure it as Windows Event Forwarder. Configure DC in a way that it will enforce all computers to send their logs to this Windows Event Forwarder. And, this Windows Event Forwarder will send all logs to my Broker VM. 
Is it working like that? 

Can anyone explain it to me?

[nsinghvirk · Accepted solution]

Hello @JahidAliyev 

Thanks for reaching out on LiveCommunity!

In order for Windows Event Collector to receive logs you need to configure a Windows Event Forwarder which can be a windows server or a domain controller. If you want to collect logs from a number of computers then you need to configure your WEF(server/DC) to collect logs from these sources and then send them to WEC.

There is no such restriction to config DC as WEF.

Please click Accept as Solution to acknowledge that the answer to your question has been provided.