Intercept X Advanced, Server Event Logs

I'm just getting started with Intercept X and when I was being demoed the product I'm sure one of the features I was shown was the ability to store the Windows Event Logs in the cloud.

But so far I've not been able to achieve this or find any documentation on it, is it possible to store the Windows Event Logs in the cloud for future analysis?

Thanks in advance.

AStaUK

AStaUK 6 months ago

Thanks for the replies, I'll dig a little deeper into the product and see what I can find.
- Cancel
- Vote Up 0 Vote Down
- More
- Cancel
Maxim-Sophos 6 months ago in reply to Qoosh

I'll add that these are not stored in the cloud, but on the endpoint itself. They can, however, be queried from the Sophos Central console.
- Cancel
- Vote Up 0 Vote Down
- More
- Cancel
Qoosh 6 months ago

Hi community.sophos.com/.../astauk, Thanks for reaching out to the Sophos Community Forum. Windows Event Logs are recorded via XDR. You can find a list of the type of events that will be used to generate XDR detections on the following page. You'll need to select "Endpoint" from the drop-down on the top left of the page. - doc.sophos.com/.../index.html Because XDR also leverages osquery, you can find more information on the tables/data accessible on the following page. - osquery.io/.../5.4.0
- Cancel
- Vote Up 0 Vote Down
- More
- Cancel

Uncategorized

Anomalies

ATT&CK

Cloud Optix

Compliance

Data Lake

Device

Email

Events

Files

Live Response

Network

Other queries

Processes

Query Tips

Registry

Threat Hunting

User

Intercept X Advanced, Server Event Logs