Forwarding event to XSIAM

[K.Ganiyev]

hi , how can i forward special event id to xsiam . For example i want to send 4624 id event log from active directory to cortex xsiam

[afurze]

Hi K.Ganiyev,

You will need to configure an appropriate method of obtaining and ingesting the event.  For customers who are deploying (or have already deployed) the Cortex XDR agent as a part of their XSIAM deployment, the XDR Agent already collects numerous Windows Event logs and uploads them to the tenant.  Customers who have not deployed the XDR Agent, or who want to collect Event IDs not supported by the XDR Agent, you can either configure the WEC applet on the Broker VM, or deploy the XDR Collector and configure it to collect the Event IDs of interest.