> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/endpoint-protection/endpoint-data-collection.md).

# Endpoint data collection

When the Cortex XDR agent raises an alert on endpoint activity, a minimum set of metadata about the endpoint is sent to the server.

When you enable behavioral threat protection or EDR data collection in your endpoint security policy, the Cortex XDR agent can also continuously monitor endpoint activity for malicious event chains identified by Palo Alto Networks. The endpoint data that the Cortex XDR agent collects when you enable these capabilities varies by platform type.

{% hint style="info" %}

### Note

Agents with Cortex XDR Pro per Endpoint apply limits and filters on network, file, and registry logs. To expand these limits and filters requires the Extended Threat Hunting Data (XTH) add-on.

The tables below note whether specific logs require the XTH add-on.
{% endhint %}

<details>

<summary>Metadata collected for Cortex XDR agent alerts</summary>

When the Cortex XDR agent raises an alert on endpoint activity, the following metadata is sent to the server:

| Field                  | Description                                                          |
| ---------------------- | -------------------------------------------------------------------- |
| Absolute timestamp     | Kernel system time                                                   |
| Relative timestamp     | Uptime since the computer started                                    |
| Thread ID              | ID of the originating thread                                         |
| Process ID             | ID of the originating process                                        |
| Process creation time  | Part of the process unique ID per boot session (PID + creation time) |
| Sequence ID            | Unique integer per boot session                                      |
| Primary user SID       | Unique identifier of the user                                        |
| Impersonating user SID | Unique identifier of the impersonating user, if applicable           |

</details>

<details>

<summary>EDR data collected for Windows endpoints</summary>

| Category                                        | Events                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | Attributes                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Mount a device (volume and hardware)            | <ul><li>Mount</li><li>Unmount</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | <ul><li>Storage device name</li><li>Storage device class GUID</li><li>Storage device class name</li><li>Storage device bus type</li><li>Storage device volume GUID</li><li>Storage device mount point</li><li>Storage device drive type</li><li>Storage device vendor ID</li><li>Storage device product ID</li><li>Storage device serial number</li><li>Storage device virtual volume image</li></ul>                                                                                 |
| Executable metadata (Traps 6.1 and later)       | Process start                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | <ul><li>File size</li><li>File access time</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| Files                                           | <ul><li>Create</li><li>Write</li><li>Delete</li><li>Rename</li><li>Move</li><li>Modification (Traps 6.1 and later)</li><li>Symbolic links (Traps 6.1 and later)</li><li>Read</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | <ul><li>Full path of the modified file before and after modification</li><li>SHA256 and MD5 hash for the file after modification</li><li>SetInformationFile for timestamps (Traps 6.1 and later)</li><li>File set security (DACL) information (Traps 6.1 and later)</li><li>Resolve hostnames on local network (Traps 6.1 and later)</li><li>Symbolic-link/hard-link and reparse point creation (Traps 6.1 and later)</li><li>File device type (regular file or Named Pipe)</li></ul> |
| Image (DLL)                                     | Load                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | <ul><li>Full path</li><li>Base address</li><li>Target process-id/thread-id</li><li>Image size</li><li>Signature (Traps 6.1 and later)</li><li>SHA256 and MD5 hash for the DLL (Traps 6.1 and later)</li><li>File size (Traps 6.1 and later)</li><li>File access time (Traps 6.1 and later)</li></ul>                                                                                                                                                                                  |
| Process                                         | <ul><li>Create</li><li>Terminate</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | <ul><li>Process ID (PID) of the parent process</li><li>PID of the process</li><li>Full path</li><li>Command line arguments</li><li>Integrity level to determine if the process is running with elevated privileges</li><li>Hash (SHA256 and MD5)</li><li>Signature or signing certificate details</li></ul>                                                                                                                                                                           |
| Thread                                          | Injection                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | <ul><li>Thread ID of the parent thread</li><li>Thread ID of the new or terminating thread</li><li>Process that initiated the thread if from another process</li></ul>                                                                                                                                                                                                                                                                                                                 |
| Network                                         | <ul><li>Accept</li><li>Connect</li><li>Create</li><li>Listen</li><li>Close</li><li>Bind</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | <ul><li>Source IP address and port</li><li>Destination IP address and port</li><li>Failed connection</li><li>Protocol (TCP/UDP)</li><li>Resolve hostnames on local network</li></ul>                                                                                                                                                                                                                                                                                                  |
| Network protocols                               | <ul><li>DNS request and UDP response</li><li>HTTP connect</li><li>HTTP disconnect</li><li>HTTP proxy parsing</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | <ul><li>Origin country</li><li>Remote IP address and port</li><li>Local IP address and port</li><li>Destination IP address and port if proxy connection</li><li>Network connection ID</li><li>IPv6 connection status (true/false)</li><li>External hostname</li></ul>                                                                                                                                                                                                                 |
| Network statistics                              | <ul><li>On-close statistics</li><li>Periodic statistics</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | <ul><li>Upload volume on TCP link</li><li>Download volume on TCP link</li></ul><p>Traps sends statistics both when a connection is closed, and at periodic intervals while the connection remains open.</p>                                                                                                                                                                                                                                                                           |
| Registry                                        | <ul><li><p>Registry value:</p><ul><li>Deletion</li><li>Set</li></ul></li><li><p>Registry key:</p><ul><li>Creation</li><li>Deletion</li><li>Rename</li><li>Addition</li><li>Modification (set information)</li><li>Restore</li><li>Save</li></ul></li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Important</strong></p><p>Ensure that the registry key is entered as a real key name, and not as a symbolic link. Otherwise, the query will not retrieve results.</p><p>Examples: </p><ul><li>Instead of <code>HKEY\_LOCAL\_MACHINE\System\CurrentControlSet</code>, which is a symbolic link, use <code>KEY\_LOCAL\_MACHINE\System\ControlSet001</code>.</li><li>Instead of <code>HKEY\_CURRENT\_USER</code>, use <code>HKEY\_USERS\&#x3C;SID></code>, where SID is either a SID of the current user or an asterisk (<code>\*</code>) to represent any SID.<br><br></li></ul></div> | <ul><li>Registry path of the modified value or key</li><li>Name of the modified value or key</li><li>Data of the modified value</li></ul>                                                                                                                                                                                                                                                                                                                                             |
| Session                                         | <ul><li>Log on</li><li>Log off</li><li>Connect</li><li>Disconnect</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | <ul><li>Interactive log-on (log-on at a computer console using credentials such as a username and password)</li><li>Session ID</li><li>Session State (equivalent to the event type)</li><li>Local (physically on the computer) or remote (connected using a terminal services session)</li></ul>                                                                                                                                                                                      |
| Host status                                     | <ul><li>Boot</li><li>Suspend</li><li>Resume</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | <ul><li>Host name</li><li>OS Version</li><li>Domain</li><li>Previous and current state</li></ul>                                                                                                                                                                                                                                                                                                                                                                                      |
| Agent status                                    | Agent start                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| User presence (Traps 6.1 and later)             | User Detection                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | Detection when a user is present or idle per active user session on the computer.                                                                                                                                                                                                                                                                                                                                                                                                     |
| <p>RPC calls</p><p>\*Requires XTH add-on</p>    | <ul><li>RpcCall</li><li>RpcPreCall</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | <ul><li>action\_rpc\_interface\_uuid</li><li>action\_rpc\_interface\_version\_major</li><li>action\_rpc\_interface\_version\_minor</li><li>action\_rpc\_func\_opnum</li><li>action\_rpc\_func\_str\_call\_fields (optional)</li><li>action\_rpc\_func\_int\_call\_fields (optional)</li><li>action\_rpc\_interface\_name</li><li>action\_rpc\_func\_name</li></ul>                                                                                                                    |
| <p>System calls</p><p>\*Requires XTH add-on</p> | Syscall types change frequently, and can be observed in each event's data.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | <ul><li>action\_syscall\_string\_params</li><li>action\_syscall\_int\_params</li><li>action\_syscall\_target\_instance\_id</li><li>action\_syscall\_target\_image\_path</li><li>action\_syscall\_target\_image\_name</li><li>action\_syscall\_target\_os\_pid</li><li>action\_syscall\_target\_thread\_id</li><li>address\_mapping</li></ul>                                                                                                                                          |
| <p>Event log</p><p>\*Requires XTH add-on</p>    | See the table below for the list of Windows Event Logs that can be sent to the server.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| .Net events                                     | <ul><li>.NET DLL Loaded</li><li>.NET DLL Loaded From Buffer</li><li>Amsi Bypass Attempt</li><li>Suspicious .NET To Win32 Calls</li><li>.NET To Native Shellcode Execution Attempt</li><li>Malicious C# Compilation and Execution Attempt</li><li>Powershell Script Execution</li><li>Obfuscated Powershell Execution Attempt</li><li>Deserialization Exploit Attempt</li><li>Webshell Execution Attempt</li><li>Suspicious ASPX execution</li><li>Exchange Vulnerability Attempt</li><li>SharePoint JWT Vulnerability Attempt</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                     | <ul><li>DotNetCommon\_DotnetCallstack</li><li>DotNetCommon\_CLRVersion</li><li>DotNetCommon\_ContentVersion</li><li>DotNetCommon\_EdrAssemblyVersion</li><li>DotNetCommon\_AppDomainId</li><li>Other attributes may be added, depending on the event type and context.</li></ul>                                                                                                                                                                                                      |

</details>

<details>

<summary>Windows event logs collected for Windows endpoints</summary>

Cortex XDR and Traps agents can send the following Windows Event Logs to the tenant.

For more information on how to set up Windows event logs collection, see [Microsoft Windows security auditing setup](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/reference/microsoft-windows-security-auditing-setup.md).

| Path                                                               | Provider                                                  | Event IDs and Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| ------------------------------------------------------------------ | --------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Application                                                        | EMET                                                      |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| Application                                                        | Windows Error Reporting                                   | Only for Windows Error Reporting (WER) events when an application stops unexpectedly                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| Application                                                        | Microsoft-Windows-User Profiles Service                   | <ul><li><strong>1511</strong>: A user logged on with a temporary profile because Windows could not find the user's local profile.</li><li><strong>1518</strong>: A profile could not be created using a temporary profile</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Application                                                        | Application Error                                         | **1000**: Application unexpected stop/hang events, similar to WER/1001. These events include the full path to the EXE file, or to the module with the fault.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Application                                                        | Application Hang                                          | **1002**: Application unexpected stop/hang events, similar to WER/1001. These events include the full path to the EXE file, or to the module with the fault.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Microsoft-Windows-LDAP-client                                      |                                                           | **30**: Windows Event Collector (WEC) recommended event                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| Microsoft-Windows-CAPI2/Operational                                |                                                           | <p>Windows CAPI2 logging events:</p><ul><li><strong>11</strong>: Build Chain</li><li><strong>70</strong>: A Private Key was accessed</li><li><strong>90</strong>: X509 object</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| Microsoft-Windows-DNS-Client/Operational                           |                                                           | **3008**: A DNS query was completed without local machine name resolution events, and without empty name resolution events.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| Microsoft-Windows-DriverFrameworks-UserMode/Operational            |                                                           | **2004**: Detection of User-Mode drivers loading, for potential BadUSB detection                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| Microsoft-Windows-PowerShell/Operational                           |                                                           | <ul><li><strong>4103</strong>: Block an activity</li><li><strong>4104</strong>: Remote command</li><li><strong>4105</strong>: Start command</li><li><strong>4106</strong>: Stop command</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| Microsoft-Windows-PrintService                                     | Microsoft-Windows-PrintService                            |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| Microsoft-Windows-TaskScheduler/Operational                        | Microsoft-Windows-TaskScheduler                           | **106, 129, 141, 142, 200, 201**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| Microsoft-Windows-TerminalServices-RDPClient/Operational           |                                                           | **1024**: A terminal service (TS) attempted to connect to a remote server                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| Microsoft-Windows-Windows Defender/Operational                     |                                                           | <ul><li><strong>1006</strong>: Microsoft Defender Antivirus detected suspicious behavior</li><li><strong>1009</strong>: Microsoft Defender Antivirus restored an item from quarantine</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| Microsoft-Antimalware-Scan-Interface                               |                                                           | **1101**: Anti-Malware Scan Interface (AMSI) content scan event                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| Microsoft-Windows-Windows Defender/Operational                     |                                                           | <ul><li><strong>1116</strong>: Microsoft Defender Antivirus detected malware or other potentially unwanted software</li><li><strong>1119</strong>: Microsoft Defender Antivirus encountered a critical error when taking action on malware or other potentially unwanted software</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| Microsoft-Windows-Windows Firewall With Advanced Security/Firewall | Microsoft-Windows-Windows Firewall With Advanced Security | **2004, 2005, 2006, 2009, 2033**: Windows Firewall With Advanced Security Local Modifications (Levels 0, 2, 4)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| Security                                                           |                                                           | **1102**: The Security log cleared events                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| Security                                                           | Microsoft-Windows-Eventlog                                | Event log service events specific to the Security channel                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| Security                                                           |                                                           | <ul><li><strong>4880</strong>: Certificate Authority Service stopped</li><li><strong>4881</strong>: Certificate Authority Service started</li><li><strong>4896</strong>: Certificate Authority database rows were deleted</li><li><strong>4898</strong>: A Certificate Authority template was loaded</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| Security                                                           |                                                           | <p>Routing and Remote Access Service (RRAS) events (these are only generated on Microsoft IAS server)</p><ul><li><strong>6272</strong>: User access was granted.</li><li><strong>6280</strong>: User account unlocked</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| Security                                                           | Microsoft-Windows-Security-Auditing                       | <ul><li><strong>4624</strong>: Successful logon</li><li><strong>4625</strong>: Failed logon</li><li><strong>4634</strong>: Logoff</li><li><strong>4647</strong>: User initiated logoff</li><li><strong>4648</strong>: Logon attempted, explicit credentials</li><li><strong>4649</strong>: Replay attack</li><li><strong>4672</strong>: Special privileges attempted login</li><li><strong>4768</strong>: Kerberos TGT request</li><li><strong>4769</strong>: Kerberos service ticket requested</li><li><strong>4770</strong>: Kerberos service ticket renewal</li><li><strong>4771</strong>: Kerberos pre-authentication failed</li><li><strong>4776</strong>: Domain controller validation attempt</li><li><strong>4778</strong>: Session was reconnected to a Windows station</li><li><strong>4800</strong>: Workstation locked</li><li><strong>4801</strong>: Workstation unlocked</li><li><strong>4802</strong>: Screensaver was invoked</li><li><strong>4803</strong>: Screensaver was dismissed</li></ul>                                                                                                                                                                                                                                                                                      |
| Security                                                           | Microsoft-Windows-Security-Auditing                       | <ul><li><strong>4720</strong>: A user account was created</li><li><strong>4722</strong>: A user account was enabled</li><li><strong>4723</strong>: An attempt was made to change an account's password</li><li><strong>4724</strong>: An attempt was made to reset an account’s password</li><li><strong>4725</strong>: A user account was disabled</li><li><strong>4726</strong>: A user account was deleted</li><li><strong>4727, 4731, 4754</strong>: Creation of Groups</li><li><strong>4728, 4732, 4756</strong>: Group member additions</li><li><strong>4729, 4733, 4757</strong>: Group member removals</li><li><strong>4735, 4737, 4755, 4764</strong>: Group changes</li><li><strong>4738</strong>: A user account was changed</li><li><strong>4740</strong>: A user account was locked out</li><li><strong>4741</strong>: A computer account was created</li><li><strong>4742</strong>: A computer account was changed</li><li><strong>4743</strong>: A computer account was deleted</li><li><strong>4765, 4766</strong>: SID history</li><li><strong>4767</strong>: A user account was unlocked</li><li><strong>4780</strong>: ACL set on accounts</li><li><strong>4781</strong>: The name of an account was changed</li><li><strong>4799</strong>: Group membership enumeration</li></ul> |
| Security                                                           | Microsoft-Windows-Security-Auditing                       | <ul><li><strong>4616</strong>: System time was changed</li><li><strong>4821</strong>: Kerberos service ticket was denied</li><li><strong>4822, 4823</strong>: New Technology LAN Manager (NTLM) authentication failed</li><li><strong>4824</strong>: Kerberos pre-authentication failed</li><li><strong>4825</strong>: A user was denied access to Remote Desktop</li><li><strong>5058</strong>: Key file operation</li><li><strong>5059</strong>: Key migration operation</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| Security                                                           | Microsoft-Windows-Security-Auditing                       | <ul><li><strong>4698</strong>: A scheduled task was created</li><li><strong>4702</strong>: A scheduled task was updated</li><li><strong>4886</strong>: Certificate Services received a certificate request</li><li><strong>4887</strong>: Certificate Services approved a certificate request</li><li><strong>4899</strong>: A Certificate Services template was updated</li><li><strong>4900</strong>: Certificate Services template security was updated</li><li><strong>5140</strong>: A network share object was accessed</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| Security                                                           | Microsoft-Windows-Security-Auditing                       | **4713**: Kerberos policy was changed on a domain controller                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Security                                                           | Microsoft-Windows-Security-Auditing                       | **4662**: An operation was performed on an Active Directory object                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |

</details>

<details>

<summary>EDR data collected for Mac endpoints</summary>

| Category                                     | Events                                                                                                                | Attributes                                                                                                                                                                                                                                                                                                  |
| -------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| <p>Files</p><p>\*Requires XTH add-on</p>     | <ul><li>Create</li><li>Write</li><li>Delete</li><li>Rename</li><li>Move</li><li>Open</li></ul>                        | <ul><li>Full path of the modified file before and after modification</li><li>SHA256 and MD5 hash for the file after modification</li></ul>                                                                                                                                                                  |
| Process                                      | <ul><li>Start</li><li>Stop</li></ul>                                                                                  | <ul><li>Process ID (PID) of the parent process</li><li>PID of the process</li><li>Full path</li><li>Command line arguments</li><li>Integrity level to determine if the process is running with elevated privileges</li><li>Hash (SHA256 and MD5)</li><li>Signature or signing certificate details</li></ul> |
| Network                                      | <ul><li>Accept</li><li>Connect</li><li>Connect Failure</li><li>Disconnect</li><li>Listen</li><li>Statistics</li></ul> | <ul><li>Source IP address and port</li><li>Destination IP address and port</li><li>Failed connection</li><li>Protocol (TCP/UDP)</li><li>Aggregated send/receive statistics for the connection</li></ul>                                                                                                     |
| <p>Event log</p><p>\*Requires XTH add-on</p> | <ul><li>Authentication</li></ul>                                                                                      | <ul><li>Provider Name</li><li>Data fields</li><li>Message</li></ul>                                                                                                                                                                                                                                         |

</details>

<details>

<summary>EDR data collected for Linux endpoints</summary>

| Category                                     | Events                                                                                             | Attributes                                                                                                                                                                                                                                            |
| -------------------------------------------- | -------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| <p>Files</p><p>\*Requires XTH add-on</p>     | <ul><li>Create</li><li>Open</li><li>Write</li><li>Delete</li></ul>                                 | <ul><li>Full path of the file</li><li>Hash of the file</li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>For specific files only and only if the file was written.</p></div> |
|                                              | <ul><li>Copy</li><li>Move (rename)</li></ul>                                                       | <ul><li>Full paths of both the original and the modified files</li></ul>                                                                                                                                                                              |
|                                              | <p></p><ul><li>Change owner (chown)</li><li>Change mode (chmod)</li></ul>                          | <p></p><ul><li>Full path of the file</li><li>Newly set owner/attributes</li></ul>                                                                                                                                                                     |
| Network                                      | <ul><li>Listen</li><li>Accept</li><li>Connect</li><li>Connect failure</li><li>Disconnect</li></ul> | <ul><li>Source IP address and port for explicit binds</li><li>Destination IP address and port</li><li>Failed TCP connections</li><li>Protocol (TCP/UDP)</li></ul>                                                                                     |
| Process                                      | <ul><li>Start</li></ul>                                                                            | <ul><li>PID of the child process</li><li>PID of the parent process</li><li>Full image path of the process</li><li>Command line of the process</li><li>Hash of the image (SHA256 & MD5)</li></ul>                                                      |
|                                              | <ul><li>Stop</li></ul>                                                                             | <ul><li>PID of the stopped process</li></ul>                                                                                                                                                                                                          |
| <p>Event log</p><p>\*Requires XTH add-on</p> | <ul><li>Authentication</li></ul>                                                                   | <ul><li>Provider Name</li><li>Data fields</li><li>Message</li></ul>                                                                                                                                                                                   |

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/endpoint-protection/endpoint-data-collection.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.