Endpoint
The deployment exposes an HTTP Event Collector compatible listener. In the sending product, set the HEC URL to the deployment's HEC listener and use the ingest key as the HEC token. Both the /services/collector and /services/collector/event paths are accepted.
Fields
HEC envelopes carry event, time, host, source, sourcetype and index. XenXDR maps time to @timestamp, host to host.name, sourcetype to event.module where a mapping exists, and keeps the rest under fields. Known source types, for example common firewall and web server types, are normalised further.
Tenancy
A per-organization ingest key as the HEC token stamps the organization. The deployment-wide shared key lands in the default organization.
Acknowledgements
The listener returns HEC-style acknowledgements so that senders configured with indexer acknowledgement keep working.