Reference

[cloud-service-provider-permissions](reference/cloud-service-provider-permissions)

[microsoft-windows-security-auditing-setup](reference/microsoft-windows-security-auditing-setup)

[xdm-fields-for-mapping-authentication-events](reference/xdm-fields-for-mapping-authentication-events)

[cortex-network-scanner-oss](reference/cortex-network-scanner-oss)

[fair-usage-policy-for-cortex-xsiam](reference/fair-usage-policy-for-cortex-xsiam)

Sub-topics

• Cloud service provider permissions
• Microsoft Windows security auditing setup
  • Enable security auditing event IDs
    • Enable security auditing event IDs with GPO
    • Set up local machine security auditing without GPO
    • Additional setup for Active Directory Certificate Services (ADCS) events
    • Enable auditing access to AD domain objects - 4662
  • Enable additional event logs using Event Viewer
  • Enable LDAP server events logging (1644)
    • Enable LDAP server events logging using RegEdit
    • Enable LDAP server events logging using GPO
    • Validate log collection for LDAP Server events
• XDM fields for mapping authentication events
• Cortex Network Scanner OSS
• Fair Usage policy for Cortex XSIAM