[Cortex XSIAM ] XDR Collector Collect Windows Security Log。XDR Collectors Administration Status display "Error".

[j.chen644219]

Currently, I'm using the default templates.

Despite trying many tests, this error message persists.

Am I missing any information?

XDR Collectors Administration Status display "Error".

Error Message : 
Exiting: no modules or inputs enabled and configuration reloading disabled.
What files do you want me to watch?

XDR Collectors Administration

View Collector Policy - Filebeat  (Use Default Template)
View Collector Policy - Winlogbeat (Windows Security / Microsoft ADFS Template)

Query Builder - search microsoft_windows_raw  (collected windows security log)

I would appreciate any further suggestions on how to resolve this.

Thank you.

[j.chen644219]

Now the profile changed Configuration .

I'm wondering if the YAML itself is the problem.

It's possible that XDRC is unable to communicate with XSIAM.

1. Remove the agent remotely via XSIAM.

2. Changes to the weblogbeat profile's YAML file can be synchronized to the Windows server.

Therefore, I don't understand...

1. What does this "error" status affect?

​​2. What does this "Error" status mean?

• winlogbeat YAML :

---
winlogbeat.event_logs:
- name: Security
ignore_older: 1h
processors:
- drop_event.when.not.or:
- regexp.winlog.event_id: (110[0-2]|462[45]|4634|464[78]|4662|4672|4674|46[89]8)
- regexp.winlog.event_id: (4702|4713|4720|472[2-9]|473[1-3578]|474[0-3]|475[4-7]|476[4-9])
- regexp.winlog.event_id: (477[0126]|4780|4799|480[0-3]|482[1-5]|488[67]|4899|4900|505[89]|5061|5140)
- name: System
- name: Application

• YAML Test is "Valid YAML!"

• Query Log