What firewall settings are needed for the WEC server and event sources? June 20, 2023 05:05 Updated Open ports for: The WEC server to receive event logs from event sources and send the collated logs to SOC. The event sources to forward event logs to the WEC server. Related articles WEC Server Can AARNet provide guidance on the sizing of the WEC server? How are logs/events collected at the WEC server exported to the AARNet SIEM? Is there a way to determine the size of the disk based on the number of events seen in our environment? Set up streaming from Microsoft Entra ID logs to event hub