Learn more about activating the Windrows Event Collector on Windows Core OS to connect with the Broker VM.
After you have configured and registered your Broker VM, you can activate your Windows Event Collector application on Windows Core OS (WCOS). WCOS is a stripped-down, lightweight version of Windows that can be adapted to run on a wide variety of devices with minimal work compared to the previous way explained in Activate Windows Event Collector.
The Windows Event Collector (WEC) runs on the Broker VM collecting event logs from Windows Servers, including Domain Controllers (DCs). The Windows Event Collector can be deployed in multiple setups, and can be connected directly to multiple event generators (DCs or Windows Servers) or routed using one or more Windows Event Collectors. Behind each Windows event collector there may be multiple generating sources.
To enable the collection of the event logs, you are configuring and establishing trust between the Windows Event Forwarding (WEF) collectors and the WEC. Establishing trust between the WEFs and the WEC is achieved by mutual authentication over TLS using server and client certificates. The WEF, a WinRM plugin, runs under the Network Service account. Therefore, you need to provide the WEFs with the relevant certificates and grant the account access permissions to the private key used for client authentication, for example, authenticate with WEC.
Danger
Ensure you meet the following prerequisites before activating the Windows Event Collector applet on Windows Core:
Broker VM version 8.0 and later
You have knowledge of Windows Active Directory and Domain Controllers.
You must configure different settings related to the FQDN where the instructions differ depending on whether you are configuring a standalone Broker VM or High Availability (HA) cluster.
Windows Server 2012 r2 or later.
After ingestion, Cortex XDR normalizes and saves the Windows event logs in the dataset xdr_data
. The normalized logs are also saved in a unified format in microsoft_windows_raw
. This enables you to search the data using XQL queries, build correlation rules, and generate dashboards based on the data.
Perform the following procedures in the order listed below.