Enable additional event logs using Event Viewer - Administrator Guide - Cortex XSIAM - Cortex

Enable additional event logs using Event Viewer - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Documentation

Product

Cortex XSIAM

Creation date

2024-03-06

Last date published

2025-01-26

Event IDs 1511, 1518

In Event Viewer → Expand Applications and Services Logs → Microsoft → Windows → User Profile Service, right click Operational and select Enable Log.

Event IDs 11, 70, 90

In Event Viewer → Expand Applications and Services Logs → Microsoft → Windows → CAPI2, right click Operational and select Enable Log.

Event ID 3008

In Event Viewer → Expand Applications and Services Logs → Microsoft → Windows → DNS Client Events, right click Operational and select Enable Log.

Event ID 2004

In Event Viewer → Expand Applications and Services Logs → Microsoft → Windows → DriverFrameworks-UserMode, right click Operational and select Enable Log.

Event IDs 4103, 4104, 4105, 4106

In Event Viewer → Expand Applications and Services Logs → Microsoft → Windows → PowerShell, right click Operational and select Enable Log.

Event IDs 1006, 1009, 1116, 1119

In Event Viewer → Expand Applications and Services Logs → Microsoft → Windows → Windows Defender, right click Operational and select Enable Log.

Event ID 1024

In Event viewer → Application and Services Logs → Microsoft → Windows → TerminalServices-ClientActiveXCore → Microsoft-Windows-TerminalServices-RDPClient, right click Operational and select Enable Log.

Event IDs 2005, 2006, 2009, 2033

In Event Viewer → Expand Applications and Services Logs → Microsoft → Windows → Windows Firewall With Advanced Security → Firewall, right click Operational and select Enable Log.