How can a customer ingest additional events from a Windows DHCP server into Cortex XDR with minimal configuration?

Question

Options

• AActivate Windows Event Collector (WEC)
• BInstall the XDR Collector
• CEnable HTTP collector integration
• DInstall the Cortex XDR agent

• B
  89% (24)
• C
  7% (2)
• D
  4% (1)

Explanation

Installing the XDR Collector (B) is the correct choice because it is a lightweight, agentless data collection tool specifically designed to ingest logs and events from infrastructure sources like Windows DHCP servers without requiring a full agent deployment - making it the minimal-configuration solution.

Why the distractors are wrong:

• A (Windows Event Collector): WEC is a native Windows feature for forwarding events between Windows machines, but it doesn't natively pipe data into Cortex XDR without additional configuration and a separate collector receiving those events.
• C (HTTP Collector integration): HTTP collectors are used to ingest data from third-party sources via a REST API - they require custom development/integration work, which is far from "minimal configuration."
• D (Cortex XDR Agent): The agent is endpoint-focused and designed to protect and monitor the host it's installed on, not to collect infrastructure service logs like DHCP events from a server role.

Memory tip: Think of the XDR Collector as the "plug-and-play pipe" - it slots into existing infrastructure (like DHCP, DNS, or AD servers) to forward events with minimal setup, whereas the agent guards the endpoint itself. If the question mentions a server role (DHCP, DNS) and minimal config, reach for the Collector, not the agent.

No community discussion yet for this question.