Audit & Logging
Windows security event IDs that matter
A practical reference to the Windows event IDs worth collecting and alerting on: logons, failure codes, Kerberos, account changes, persistence and tampering.
Foundation
Guides tagged
#audit-policy
Audit & Logging
Windows audit policy and Sysmon: a logging baseline
Configure advanced audit policy subcategories, command-line capture, log sizes, Sysmon and Windows Event Forwarding so Windows logs can answer who, what, where and when.
Foundation