Renew WEC certificates - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Select Settings → Configurations → Data Broker → Broker VMs.

Do one of the following:

In the Windows Event Forwarder Configuration window, perform the following tasks:

1. In the Subscription Manager URL field, click (copy) . This will be used when you configure the subscription manager in the GPO (Global Policy Object) on your domain controller.

2. Enter a password in the Define Client Certificate Export Password field to be used to secure the downloaded WEF certificate that establishes the connection between your DC/WEF and the WEC. You will need this password when the certificate is imported to the events forwarder.

3. Download the WEF certificate in a PFX format to your local machine.

Install your WEF Certificate on the WEF to establish connection.

1. Locate the PFX file you downloaded from the Cortex XSIAM console and double-click to open the Certificate Import Wizard.

2. In the Certificate Import Wizard:

   1. Select Local Machine, and then click Next.

   2. Verify the File name field displays the PFX certificate file you downloaded and click Next.

   3. In the Passwords field, enter the Client Certificate Export Password you defined in the Cortex XSIAM console followed by Next.

   4. Select Automatically select the certificate store based on the type of certificate, and then click Next and Finish.

3. From a command prompt, run certlm.msc.

4. In the file explorer, navigate to Certificates and verify the following for each of the folders:

   • In the Personal → Certificates folder, ensure the certificate forwarder.wec.paloaltonetworks.com is displayed.

   • In the Trusted Root Certification Authorities → Certificates folder, ensure the CA ca.wec.paloaltonetworks.com is displayed.

   Note

   You can see more than one ca.wec.paloaltonetworks.com and forwarder.wec.paloaltonetworks.com file from a previous installation in the directory, so select the file with the most extended Expiration Date. You can verify that you are using the correct certificate:

   • To verify the client certificate in the Personal → Certificates folder is related to the CA, you can select your forwarder.wec.paloaltonetworks.com file and from the Certification Path tab, double-click ca.wec.paloaltonetworks.com. In the Details tab, Show: Properties only, and verify the Thumbprint matches the ca.wec.paloaltonetworks.com file Thumbprint.

   • For the Trusted Root Certificate (i.e. CA certificate), you can verify the Thumbprint of your ca.wec.paloaltonetworks.com file matches the Subscription Manager URL by double-clicking the file and from the Details tab verifying the Thumbprint.

5. Navigate to Certificates Personal Certificates.

6. Right-click the certificate and navigate to All tasks → Manage Private Keys.

7. In the Permissions window, select Add and in the Enter the object name section, enter NETWORK SERVICE, and then click Check Names to verify the object name. The object name is displayed with an underline when valid. and then click OK.

   

8. Click OK, verify the Group or user names that are displayed, and then click Apply Permissions for private keys.

   

Configure the subscription manager.

1. Navigate to Computer Configuration → Policies → Administrative Templates: Policy definitions → Windows Components → Event Forwarding, right-click Configure target Subscription Manager and select Edit.

   

2. In the Configure target Subscription Manager window, perform the following:

   1. Mark Configure target Subscription Manager as Enabled.

   2. In the Options section, select Show and in the Show Contents window, paste the Subscription Manage URL you copied from the Cortex XSIAM console, and then click OK.

   3. Click Apply and OK to save your changes.

Complete the WEF Client certificate renewal.

On every WEF DC, perform the following from a command prompt:

1. Run gpupdate /force to update the group policy.

2. To apply the configurations, Restart-Service WinRM.

Select Settings → Configurations → Data Broker → Broker VMs.

Do one of the following:

Click Renew.

Once Cortex XSIAM renews the WEC server certificate, the status of the WEC in the APPS field on the Broker VMs machine is Connected indicating the applet is running. In addition, the health status of the Windows Event Collector applet is now green instead of yellow and the warning message that appeared when you hovered over the health status no longer appears. Your WEC server certificate is issued with a lifespan of 12 months.

We also suggest that you run the following XQL query to verify that your event logs are being captured:

dataset = xdr_data 
| filter _product = "Windows" 
| fields _vendor,_product,action_evtlog_level,action_evtlog_event_id 
| sort desc _time 
| limit 20