Endpoint
The deployment exposes an HTTP Event Collector compatible listener. In the sending product, set the HEC URL to the deployment's HEC listener and use the deployment's shared ingest key as the HEC token. Both the /services/collector and /services/collector/event paths are accepted.
Fields
HEC envelopes carry event, time, host, source, sourcetype and index. XenXDR maps time to @timestamp, host to host.name, sourcetype to event.dataset and source to the product, and keeps the rest under fields.
Tenancy
Events sent over HEC land in the deployment's default organization. To send into a specific organization, use the HTTP JSON endpoint with that organization's ingest key.