LIVEcommunity - Who Me Too'd this topic

Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.

Hello, dear Community,

I need a list of Windows event IDs required for BIOC and other Cortex XDR rules to work effectively.

For example, when we performed a Kerberos user enumeration attack using Kerbrute, it was not detected initially. Cortex XDR requires event ID 4768 to be enabled to detect such an attack. After enabling this event ID and testing the attack simulation again, it was successfully detected.

I am now wondering which event IDs are crucial to enable in order to maximize detection opportunities for Cortex XDR. It would be great to get a list of these event IDs.

Thanks.

Who Me Too'd this topic

L0 Member

Me Too date:

Unlock your full community experience!

Who Me Too'd this topic

Required Windows Event IDs for the best Cortex XDR detection performance