Enable security auditing event IDs

Enable Windows security auditing event IDs for Cortex XSIAM using GPO or local machine settings.

You can enable security auditing events using GPO or set them up on a local server. Active Directory Certificate Services (ADCS) events require additional setup.

Note

We recommend you configure security auditing using Group Policy Object (GPO). Using GPO simplifies audit management and ensures that auditing settings are uniformly applied across your network, reducing the risk of misconfigurations on individual machines.