Activate the Windows Event Collector - Administrator Guide - Cortex XDR - Cortex - Security Operations

In Cortex XDR, select Settings → Configurations → Data Broker → Broker VM and under Brokers, locate your Broker VM.

You can either right-click the Broker VM and select Add App → Windows Event Collector, or hover in the APPS column, and select Add → Windows Event Collector.

In the Activate Windows Event Collector window, define the Collected Events.

Configure the events collected by the applet. This lists event sources from which you want to collect events.

For example, to forward all the Windows Event Collector events to the Broker VM, define as follows:

Activate your configurations.

After a successful activation, the APPS field displays WEC with a green dot indicating a successful connection.

Hover over the WEC connection in the APPS column to display the Windows Event Collector settings, and select Configure.

In the Windows Event Forwarder Configuration window, perform the following tasks.

1. (copy) the Subscription Manager URL. This will be used when you configure the subscription manager in the GPO (Global Policy Object) on your domain controller.

2. Define Client Certificate Export Password used to secure the downloaded WEF certificate used to establish the connection between your DC/WEF and the WEC. You will need this password when the certificate is imported to the events forwarder.

3. Download the WEF certificate in a PFX format to your local machine.

   To view your Windows Event Forwarding configuration details at any time, select your Broker VM, right-click and navigate to Windows Event Collector → Configure.

Cortex XDR monitors the certificate and triggers a Certificate Expiration notification 30 days prior to the expiration date. The notification is sent daily specifying the number of days left on the certificate, or if the certificate has already expired.

Install your WEF Certificate on the WEF to establish connection.

1. Locate the PFX file you downloaded from the Cortex XDR console and double-click to open the Certificate Import Wizard.

2. In the Certificate Import Wizard:

   1. Select Local Machine followed by Next.

   2. Verify the File name field displays the PFX certificate file you downloaded and select Next.

   3. In the Passwords field, specify the Client Certificate Export Password you defined in the Cortex XDR console followed by Next.

   4. Select Automatically select the certificate store based on the type of certificate followed by Next and Finish.

3. From a command prompt, run certlm.msc.

4. In the file explorer, navigate to Certificates and verify the following for each of the folders.

   • In the Personal → Certificates folder, ensure the certificate forwarder.wec.paloaltonetworks.com appears.

   • In the Trusted Root Certification Authorities → Certificates folder, ensure the CA ca.wec.paloaltonetworks.com appears.

5. Navigate to Certificates → Personal → Certificates.

6. Right-click the certificate and navigate to All tasks → Manage Private Keys.

7. In the Permissions window, select Add and in the Enter the object name section, specify NETWORK SERVICE followed by Check Names to verify the object name. The object name is displayed with an underline when valid. and then OK.

   

8. Select OK, verify the Group or user names appear, and then Apply Permissions for private keys.

   

Add the Network Service account to the domain controller Event Log Readers group.

1. To enable events forwarders to forward events, the Network Service account must be a member of the Active Directory Event Log Readers group. In PowerShell, execute the following command on the domain controller that is acting as the event forwarder:

   PS C:\> net localgroup "Event Log Readers" "NT Authority\Network Service" /add

   Make sure you see The command completed successfully message.

2. Grant access to view the security event logs.

   1. Run wevtutil gl security and take note of your channelAccess value.

      For example:

      `PS C:\Users\Administrator> wevtutil gl security
      name: security
      enabled: true
      type: Admin
      owningPublisher:
      isolation: Custom
      channelAccess: O:BAG:SYD:(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;S-1-5-32-573)
      logging:
        logFileName: %SystemRoot%\System32\Winevt\Logs\security.evtx
        retention: false
        autoBackup: false
        maxSize: 134217728
      publishing:
        fileMax: 1
      

      Take note of value: channelAccess: O:BAG:SYD:(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;S-1-5-32-573)

   2. Run wevtutil sl security "/ca:<channelAccess value>(A;;0x1;;;S-1-5-20)"

      For example:

      PS C:\Users\Administrator> wevtutil sl security "/ca:O:BAG:SYD:(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;S-1-5-32-573)(A;;0x1;;;S-1-5-20)"

   Make sure you grant access on each of your domain controller hosts.

Create a WEF Group Policy that applies to every Windows server you want to configure as a WEF.

1. In a command prompt, open gpmc.msc.

2. In the Group Policy Management window, navigate to Domains → your domain name → Group Policy Object, right-click and select New.

3. In the New GPO window, enter your group policy Name: Windows Event Forwarding followed by OK.

4. Navigate to Domains → your domain name → Group Policy Objects → Windows Event Forwarding, right-click and select Edit.