Set up your Windows Event Collector to connect with the Cortex XSIAM Broker VM and collect events.
After you have configured and registered your Broker VM, activate your Windows Event Collector application.
The Windows Event Collector (WEC) runs on the Broker VM collecting event logs from Windows Servers, including Domain Controllers (DCs). The Windows Event Collector can be deployed in multiple setups, and can be connected directly to multiple event generators (DCs or Windows Servers) or routed using one or more Windows Event Collectors. Behind each Windows event collector there may be multiple generating sources.
To enable the collection of the event logs, you need to configure and establish trust between the Windows Event Forwarding (WEF) collectors and the WEC. Establishing trust between the WEFs and the WEC is achieved by mutual authentication over TLS using server and client certificates. The WEF, a WinRM plugin, runs under the Network Service account. Therefore, you need to provide the WEFs with the relevant certificates and grant the account access permissions to the private key used for client authentication, for example, authenticate with WEC.
Note
You can also activate the Windows Event Collector on Windows Core. For more information, see Activate Windows Event Collector on Windows Core.
Danger
Ensure you meet the following prerequisites before activating the Windows Event Collector applet:
Broker VM version 8.0 and later
You have knowledge of Windows Active Directory and Domain Controllers.
You must configure different settings related to the FQDN where the instructions differ depending on whether you are configuring a standalone Broker VM or High Availability (HA) cluster.
Windows Server 2012 r2 or later.
After ingestion, Cortex XSIAM normalizes and saves the Windows event logs in the dataset xdr_data
. The normalized logs are also saved in a unified format in microsoft_windows_raw
. This enables you to search the data using Cortex Query Language (XQL) queries, build correlation rules, and generate dashboards based on the data.
Perform the following procedures in the order listed below.