Enable security auditing event IDs - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Documentation
Product
Cortex XSIAM
Creation date
2024-03-06
Last date published
2025-01-26
Category
Administrator Guide

You can enable security auditing events using GPO or set them up on a local server. Active Directory Certificate Services (ADCS) events require additional setup.

Note

We recommend you configure security auditing using Group Policy Object (GPO). Using GPO simplifies audit management and ensures that auditing settings are uniformly applied across your network, reducing the risk of misconfigurations on individual machines.