Windows Firewall
Windows Firewall logging and monitoring that works
Turn Windows Firewall into a detection source: configure pfirewall.log, WFP audit events 5156/5157, rule-change events 4946-4950 and forward them centrally.
Foundation
Guides tagged
#logging
PowerShell Security
PowerShell security: logging, v2 removal, CLM and JEA
Make PowerShell transparent and bounded: script block, module and transcription logging, removing PowerShell 2.0, Constrained Language Mode enforced by App Control, and Just Enough Administration.
Intermediate