Enable additional event logs using Event Viewer

Enable additional Windows Event Viewer logs, including PowerShell and Defender events, for Cortex XSIAM.

For the following event IDs, the auditing setup is configured using the Windows Event Viewer. Access the Event Viewer through the search box in the Start menu.

image34.png

Event IDs 1511, 1518

In Event Viewer → Expand Applications and Services Logs → Microsoft → Windows → User Profile Service, right click Operational and select Enable Log.

image22.png

Event IDs 11, 70, 90

In Event Viewer → Expand Applications and Services Logs → Microsoft → Windows → CAPI2, right click Operational and select Enable Log.

image36.png

Event ID 3008

In Event Viewer → Expand Applications and Services Logs → Microsoft → Windows → DNS Client Events, right click Operational and select Enable Log.

image33.png

Event ID 2004

In Event Viewer → Expand Applications and Services Logs → Microsoft → Windows → DriverFrameworks-UserMode, right click Operational and select Enable Log.

image28.png

Event IDs 4103, 4104, 4105, 4106

In Event Viewer → Expand Applications and Services Logs → Microsoft → Windows → PowerShell, right click Operational and select Enable Log.

image31.png

Event IDs 1006, 1009, 1116-1119

In Event Viewer → Expand Applications and Services Logs → Microsoft → Windows → Windows Defender, right click Operational and select Enable Log.

image35.png

Event ID 1024

In Event viewer → Application and Services Logs → Microsoft → Windows → TerminalServices-ClientActiveXCore → Microsoft-Windows-TerminalServices-RDPClient, right click Operational and select Enable Log.

image30.png

Event IDs 2005, 2006, 2009, 2033

In Event Viewer → Expand Applications and Services Logs → Microsoft → Windows → Windows Firewall With Advanced Security → Firewall, right click Operational and select Enable Log.

image17.png