Endpoint data collection ↗
When the Cortex XDR agent generates an issue on endpoint activity, a minimum set of metadata about the endpoint is sent to the server.
When you enable behavioral threat protection or EDR data collection in your endpoint security policy, the Cortex XDR agent can also continuously monitor endpoint activity for malicious event chains identified by Palo Alto Networks. The endpoint data that the Cortex XDR agent collects when you enable these capabilities varies by platform type.
Metadata collected for Cortex XDR agent issues
When the Cortex XDR agent generates an issue on endpoint activity, the following metadata is sent to the server:
| Field | Description |
|---|---|
| Absolute timestamp | Kernel system time |
| Relative timestamp | Uptime since the computer started |
| Thread ID | ID of the originating thread |
| Process ID | ID of the originating process |
| Process creation time | Part of the process unique ID per boot session (PID + creation time) |
| Sequence ID | Unique integer per boot session |
| Primary user SID | Unique identifier of the user |
| Impersonating user SID | Unique identifier of the impersonating user, if applicable |
EDR data collected for Windows endpoints
| Category | Events | Attributes |
|---|---|---|
| Mount a device (volume and hardware) | <ul><li>Mount</li><li>Unmount</li></ul> | <ul><li>Storage device name</li><li>Storage device class GUID</li><li>Storage device class name</li><li>Storage device bus type</li><li>Storage device volume GUID</li><li>Storage device mount point</li><li>Storage device drive type</li><li>Storage device vendor ID</li><li>Storage device product ID</li><li>Storage device serial number</li><li>Storage device virtual volume image</li></ul> |
| Executable metadata | Process start | <ul><li>File size</li><li>File access time</li></ul> |
| Files | <ul><li>Create</li><li>Write</li><li>Delete</li><li>Rename</li><li>Move</li><li>Modification</li><li>Symbolic links</li><li>Read</li></ul> | <ul><li>Full path of the modified file before and after modification</li><li>SHA256 and MD5 hash for the file after modification</li><li>SetInformationFile for timestamps</li><li>File set security (DACL) information</li><li>Resolve hostnames on local network</li><li>Symbolic-link/hard-link and reparse point creation</li><li>File device type (regular file or Named Pipe)</li></ul> |
| Image (DLL) | Load | <ul><li>Full path</li><li>Base address</li><li>Target process-id/thread-id</li><li>Image size</li><li>Signature</li><li>SHA256 and MD5 hash for the DLL</li><li>File size</li><li>File access time</li></ul> |
| Process | <ul><li>Create</li><li>Terminate</li></ul> | <ul><li>Process ID (PID) of the parent process</li><li>PID of the process</li><li>Full path</li><li>Command line arguments</li><li>Integrity level to determine if the process is running with elevated privileges</li><li>Hash (SHA256 and MD5)</li><li>Signature or signing certificate details</li></ul> |
| Thread | Injection | <ul><li>Thread ID of the parent thread</li><li>Thread ID of the new or terminating thread</li><li>Process that initiated the thread if from another process</li></ul> |
| Network | <ul><li>Accept</li><li>Connect</li><li>Create</li><li>Listen</li><li>Close</li><li>Bind</li></ul> | <ul><li>Source IP address and port</li><li>Destination IP address and port</li><li>Failed connection</li><li>Protocol (TCP/UDP)</li><li>Resolve hostnames on local network</li></ul> |
| Network protocols | <ul><li>DNS request and UDP response</li><li>HTTP connect</li><li>HTTP disconnect</li><li>HTTP proxy parsing</li></ul> | <ul><li>Origin country</li><li>Remote IP address and port</li><li>Local IP address and port</li><li>Destination IP address and port if proxy connection</li><li>Network connection ID</li><li>IPv6 connection status (true/false)</li><li>External hostname</li></ul> |
| Network statistics | <ul><li>On-close statistics</li><li>Periodic statistics</li></ul> | <ul><li>Upload volume on TCP link</li><li>Download volume on TCP link</li></ul><p>Traps sends statistics both when a connection is closed, and at periodic intervals while the connection remains open.</p> |
| Registry | <ul><li><p>Registry value:</p><ul><li>Deletion</li><li>Set</li></ul></li><li><p>Registry key:</p><ul><li>Creation</li><li>Deletion</li><li>Rename</li><li>Addition</li><li>Modification (set information)</li><li>Restore</li><li>Save</li></ul></li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>Important</p><p>Registry key is collected as a real key name, and not as a symbolic link.</p><p>Example. **null Example. **null </p></div> |
<ul><li>Registry path of the modified value or key</li><li>Name of the modified value or key</li><li>Data of the modified value</li></ul> |
| Session | <ul><li>Log on</li><li>Log off</li><li>Connect</li><li>Disconnect</li></ul> | <ul><li>Interactive log-on (log-on at a computer console using credentials such as a username and password)</li><li>Session ID</li><li>Session State (equivalent to the event type)</li><li>Local (physically on the computer) or remote (connected using a terminal services session)</li></ul> |
| Host status | <ul><li>Boot</li><li>Suspend</li><li>Resume</li></ul> | <ul><li>Host name</li><li>OS Version</li><li>Domain</li><li>Previous and current state</li></ul> |
| Agent status | Agent start | |
| User presence | User Detection | Detection when a user is present or idle per active user session on the computer. |
| RPC calls | <ul><li>RpcCall</li><li>RpcPreCall</li></ul> | <ul><li>action_rpc_interface_uuid</li><li>action_rpc_interface_version_major</li><li>action_rpc_interface_version_minor</li><li>action_rpc_func_opnum</li><li>action_rpc_func_str_call_fields (optional)</li><li>action_rpc_func_int_call_fields (optional)</li><li>action_rpc_interface_name</li><li>action_rpc_func_name</li></ul> |
| System calls | Syscall types change frequently, and can be observed in each event's data. | <ul><li>action_syscall_string_params</li><li>action_syscall_int_params</li><li>action_syscall_target_instance_id</li><li>action_syscall_target_image_path</li><li>action_syscall_target_image_name</li><li>action_syscall_target_os_pid</li><li>action_syscall_target_thread_id</li><li>address_mapping</li></ul> |
| Event log | See the table below for the list of Windows Event Logs that can be sent to the server. | |
| .Net events | <ul><li>.NET DLL Loaded</li><li>.NET DLL Loaded From Buffer</li><li>Amsi Bypass Attempt</li><li>Suspicious .NET To Win32 Calls</li><li>.NET To Native Shellcode Execution Attempt</li><li>Malicious C# Compilation and Execution Attempt</li><li>Powershell Script Execution</li><li>Obfuscated Powershell Execution Attempt</li><li>Deserialization Exploit Attempt</li><li>Webshell Execution Attempt</li><li>Suspicious ASPX execution</li><li>Exchange Vulnerability Attempt</li><li>SharePoint JWT Vulnerability Attempt</li></ul> | <ul><li>DotNetCommon_DotnetCallstack</li><li>DotNetCommon_CLRVersion</li><li>DotNetCommon_ContentVersion</li><li>DotNetCommon_EdrAssemblyVersion</li><li>DotNetCommon_AppDomainId</li><li>Other attributes may be added, depending on the event type and context.</li></ul> |
Windows event logs collected for Windows endpoints
Cortex XDR agents can send the following Windows Event Logs to the tenant.
Cortex XSIAM saves the Windows event logs both in xdr_data and in the microsoft_windows_raw datasets.
For more information on how to set up Windows event logs collection, see Microsoft Windows security auditing setup.
| Path | Provider | Event IDs and Description |
|---|---|---|
| Application | EMET | |
| Application | Windows Error Reporting | Only for Windows Error Reporting (WER) events when an application stops unexpectedly |
| Application | Microsoft-Windows-User Profiles Service | <ul><li>1511: A user logged on with a temporary profile because Windows could not find the user's local profile.</li><li>1518: A profile could not be created using a temporary profile</li></ul> |
| Application | Application Error | 1000: Application unexpected stop/hang events, similar to WER/1001. These events include the full path to the EXE file, or to the module with the fault. |
| Application | Application Hang | 1002: Application unexpected stop/hang events, similar to WER/1001. These events include the full path to the EXE file, or to the module with the fault. |
| Microsoft-Windows-LDAP-client | 30: Windows Event Collector (WEC) recommended event | |
| Microsoft-Windows-CAPI2/Operational | <p>Windows CAPI2 logging events:</p><ul><li>11: Build Chain</li><li>70: A Private Key was accessed</li><li>90: X509 object</li></ul> | |
| Microsoft-Windows-DNS-Client/Operational | 3008: A DNS query was completed without local machine name resolution events, and without empty name resolution events. | |
| Microsoft-Windows-DriverFrameworks-UserMode/Operational | 2004: Detection of User-Mode drivers loading, for potential BadUSB detection | |
| Microsoft-Windows-PowerShell/Operational | <ul><li>4103: Block an activity</li><li>4104: Remote command</li><li>4105: Start command</li><li>4106: Stop command</li></ul> | |
| Microsoft-Windows-PrintService | Microsoft-Windows-PrintService | |
| Microsoft-Windows-TaskScheduler/Operational | Microsoft-Windows-TaskScheduler | 106, 129, 141, 142, 200, 201 |
| Microsoft-Windows-TerminalServices-RDPClient/Operational | 1024: A terminal service (TS) attempted to connect to a remote server | |
| Microsoft-Windows-Windows Defender/Operational | <ul><li>1006: Microsoft Defender Antivirus detected suspicious behavior</li><li>1009: Microsoft Defender Antivirus restored an item from quarantine</li></ul> | |
| Microsoft-Antimalware-Scan-Interface | 1101: Anti-Malware Scan Interface (AMSI) content scan event | |
| Microsoft-Windows-Windows Defender/Operational | <ul><li>1116: Microsoft Defender Antivirus detected malware or other potentially unwanted software</li><li>1117: Microsoft Defender has taken a protective action. Usually seen after code 1116</li><li>1119: Microsoft Defender Antivirus encountered a critical error when taking action on malware or other potentially unwanted software</li></ul> | |
| Microsoft-Windows-Windows Firewall With Advanced Security/Firewall | Microsoft-Windows-Windows Firewall With Advanced Security | 2004, 2005, 2006, 2009, 2033: Windows Firewall With Advanced Security Local Modifications (Levels 0, 2, 4) |
| Security | 1102: The Security log cleared events | |
| Security | Microsoft-Windows-Eventlog | Event log service events specific to the Security channel |
| Security | <ul><li>4880: Certificate Authority Service stopped</li><li>4881: Certificate Authority Service started</li><li>4896: Certificate Authority database rows were deleted</li><li>4898: A Certificate Authority template was loaded</li></ul> | |
| Security | <p>Routing and Remote Access Service (RRAS) events (these are only generated on Microsoft IAS server)</p><ul><li>6272: User access was granted.</li><li>6280: User account unlocked</li></ul> | |
| Security | Microsoft-Windows-Security-Auditing | <ul><li>4624: Successful logon</li><li>4625: Failed logon</li><li>4634: Logoff</li><li>4647: User initiated logoff</li><li>4648: Logon attempted, explicit credentials</li><li>4649: Replay attack</li><li>4672: Special privileges attempted login</li><li>4768: Kerberos TGT request</li><li>4769: Kerberos service ticket requested</li><li>4770: Kerberos service ticket renewal</li><li>4771: Kerberos pre-authentication failed</li><li>4776: Domain controller validation attempt</li><li>4778: Session was reconnected to a Windows station</li><li>4800: Workstation locked</li><li>4801: Workstation unlocked</li><li>4802: Screensaver was invoked</li><li>4803: Screensaver was dismissed</li></ul> |
| Security | Microsoft-Windows-Security-Auditing | <ul><li>4720: A user account was created</li><li>4722: A user account was enabled</li><li>4723: An attempt was made to change an account's password</li><li>4724: An attempt was made to reset an account’s password</li><li>4725: A user account was disabled</li><li>4726: A user account was deleted</li><li>4727, 4731, 4754: Creation of Groups</li><li>4728, 4732, 4756: Group member additions</li><li>4729, 4733, 4757: Group member removals</li><li>4735, 4737, 4755, 4764: Group changes</li><li>4738: A user account was changed</li><li>4740: A user account was locked out</li><li>4741: A computer account was created</li><li>4742: A computer account was changed</li><li>4743: A computer account was deleted</li><li>4765, 4766: SID history</li><li>4767: A user account was unlocked</li><li>4780: ACL set on accounts</li><li>4781: The name of an account was changed</li><li>4799: Group membership enumeration</li></ul> |
| Security | Microsoft-Windows-Security-Auditing | <ul><li>4616: System time was changed</li><li>4821: Kerberos service ticket was denied</li><li>4822, 4823: New Technology LAN Manager (NTLM) authentication failed</li><li>4824: Kerberos pre-authentication failed</li><li>4825: A user was denied access to Remote Desktop</li><li>5058: Key file operation</li><li>5059: Key migration operation</li></ul> |
| Security | Microsoft-Windows-Security-Auditing | <ul><li>4698: A scheduled task was created</li><li>4702: A scheduled task was updated</li><li>4886: Certificate Services received a certificate request</li><li>4887: Certificate Services approved a certificate request</li><li>4899: A Certificate Services template was updated</li><li>4900: Certificate Services template security was updated</li><li>5140: A network share object was accessed</li></ul> |
| Security | Microsoft-Windows-Security-Auditing | 4713: Kerberos policy was changed on a domain controller |
| Security | Microsoft-Windows-Security-Auditing | 4662: An operation was performed on an Active Directory object |
EDR data collected for Mac endpoints
| Category | Events | Attributes |
|---|---|---|
| Files | <ul><li>Create</li><li>Write</li><li>Delete</li><li>Rename</li><li>Move</li><li>Open</li></ul> | <ul><li>Full path of the modified file before and after modification</li><li>SHA256 and MD5 hash for the file after modification</li></ul> |
| Process | <ul><li>Start</li><li>Stop</li></ul> | <ul><li>Process ID (PID) of the parent process</li><li>PID of the process</li><li>Full path</li><li>Command line arguments</li><li>Integrity level to determine if the process is running with elevated privileges</li><li>Hash (SHA256 and MD5)</li><li>Signature or signing certificate details</li></ul> |
| Network | <ul><li>Accept</li><li>Connect</li><li>Connect Failure</li><li>Disconnect</li><li>Listen</li><li>Statistics</li></ul> | <ul><li>Source IP address and port</li><li>Destination IP address and port</li><li>Failed connection</li><li>Protocol (TCP/UDP)</li><li>Aggregated send/receive statistics for the connection</li></ul> |
| Event log | <ul><li>Authentication</li></ul> | <ul><li>Provider Name</li><li>Data fields</li><li>Message</li></ul> |
EDR data collected for Linux endpoints
| Category | Events | Attributes |
|---|---|---|
| Files | <ul><li>Create</li><li>Open</li><li>Write</li><li>Delete</li></ul> | <ul><li>Full path of the file</li><li>Hash of the file</li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>Note</p><p>For specific files only and only if the file was written.</p></div> |
| <ul><li>Copy</li><li>Move (rename)</li></ul> | <ul><li>Full paths of both the original and the modified files</li></ul> | |
| <ul><li>Change owner (chown)</li><li>Change mode (chmod)</li></ul> | <ul><li>Full path of the file</li><li>Newly set owner/attributes</li></ul> | |
| Network | <ul><li>Listen</li><li>Accept</li><li>Connect</li><li>Connect failure</li><li>Disconnect</li></ul> | <ul><li>Source IP address and port for explicit binds</li><li>Destination IP address and port</li><li>Failed TCP connections</li><li>Protocol (TCP/UDP)</li></ul> |
| Process | <ul><li>Start</li></ul> | <ul><li>PID of the child process</li><li>PID of the parent process</li><li>Full image path of the process</li><li>Command line of the process</li><li>Hash of the image (SHA256 & MD5)</li></ul> |
| <ul><li>Stop</li></ul> | <ul><li>PID of the stopped process</li></ul> | |
| Event log | <ul><li>Authentication</li></ul> | <ul><li>Provider Name</li><li>Data fields</li><li>Message</li></ul> |
IT performance metrics
| Field | Description |
|---|---|
| Time | <ul><li>Generated time</li><li>Timestamp</li></ul> |
| Agent information | <ul><li>Agent ID</li><li>Agent hostname</li><li>Agent OS type</li><li>Agent host boot time</li><li>Agent session start time</li><li>Agent request time</li></ul> |
| Event information | <ul><li>Event ID</li><li>Event type</li><li>Event subtype</li><li>Event version</li><li>Event timestamp</li></ul> |
| Actor information | Actor process instance ID |
| OS actor information | <ul><li>OS actor process instance ID</li><li>OS actor process OS PID</li><li>OS actor process OS name</li></ul> |
| Sample information | <ul><li>Sample start</li><li>Sample end</li></ul> |
| CPU usage information | <ul><li>CPU max</li><li>CPU average</li><li>CPU 90th percentile</li></ul> |
| Memory usage information | <ul><li>Memory max</li><li>Memory average</li><li>Memory 90th percentile</li></ul> |
| Vendor | Vendor name |
| Product | Product name |
| ZIP | ZIP ID |
| Server information | Server request time |