Skip to main content

Microsoft Endpoint Configuration Manager

Download With Dependencies

The configuration manager provides the overall Configuration Management (CM) infrastructure and environment to the product development team (formerly known as SCCM).

This pack includes XSIAM content.

Collect Events from Vendor

In order to use the collector, please use the following option to collect events from the vendor:

You will need to configure the vendor and product for this specific collector.

XDRC (XDR Collector)

You will need to use the information described here.\
You can configure the vendor and product by replacing [vendor]_[product]_raw with msft_ecm_raw
When configuring an XDR collector profile, you should use a yml that will be used, among other things, to configure the vendor and product. This example demonstrates how to set it, specifically for the Microsoft ECM product:

filebeat.inputs:
- type: filestream
  enabled: true
  paths:
    - "C:\\Program Files\\Microsoft Configuration Manager\\Logs\\*.log"
  processors:
    - add_fields:
        fields:
          vendor: msft
          product: ecm

Please note: The above configuration uses the default location of the logs. In case your Microsoft ECM server saves the logs under a different location, you would need to change it in the yaml (under the paths field).

This pack includes XSIAM content.

Collect Events from Vendor

In order to use the collector, please use the following option to collect events from the vendor:

You will need to configure the vendor and product for this specific collector.

XDRC (XDR Collector)

You will need to use the information described here.\
You can configure the vendor and product by replacing [vendor]_[product]_raw with msft_ecm_raw
When configuring an XDR collector profile, you should use a yml that will be used, among other things, to configure the vendor and product. This example demonstrates how to set it, specifically for the Microsoft ECM product:

filebeat.inputs:
- type: filestream
  enabled: true
  paths:
    - "C:\\Program Files\\Microsoft Configuration Manager\\Logs\\*.log"
  processors:
    - add_fields:
        fields:
          vendor: msft
          product: ecm

Please note: The above configuration uses the default location of the logs. In case your Microsoft ECM server saves the logs under a different location, you would need to change it in the yaml (under the paths field).

PUBLISHER

Cortex

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

CertificationRead more
Supported ByCortex
CreatedNovember 9, 2020
Last ReleaseJanuary 7, 2024
WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER
Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.