Log events from a previously deployed Windows XDR Collector agent are no longer being observed in the console after an OS upgrade. Which aspect of the log events is the probable cause of this…

Question

Options

• AThey are greater than 5MB
• BThey are in Winlogbeat format
• CThey are in Filebeat format
• DThey are less than 1MB

• A
  73% (22)
• B
  17% (5)
• C
  7% (2)
• D
  3% (1)

Explanation

Cortex XDR Collectors enforce a maximum log event size limit of 5MB - any single log event exceeding this threshold is silently dropped and never forwarded to the console. An OS upgrade can change the verbosity, structure, or content of Windows event logs, causing previously acceptable events to balloon past this limit, which explains why logs were working before the upgrade but not after. Options B and C are distractors because Winlogbeat and Filebeat are both supported log formats for XDR ingestion - the format itself is not the issue. Option D is wrong because smaller logs (under 1MB) are well within the acceptable size range and would be processed normally. Memory tip: Think "5MB = Five-Megabyte Barrier" - if XDR goes silent after an OS change, the first thing to check is whether bloated event payloads are hitting the ceiling.

No community discussion yet for this question.