Windows Event Collector (WEC) - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR Pro Administrator Guide

Product
Cortex XDR
License
Pro
Creation date
2024-02-26
Last date published
2024-06-09
Category
Administrator Guide

Windows Event Collector (WEC). The WEC runs on the Broker VM collecting event logs from Windows Servers, including Domain Controllers (DCs). The WEC can be deployed in multiple setups, and can be connected directly to multiple event generators (DCs or Windows Servers) or routed using one or more WECs. Behind each WEC there may be multiple generating sources.