Audit & Logging
Windows Event Forwarding at scale
Windows Event Forwarding that holds up: collectors, source-initiated subscriptions, XPath queries, delivery tuning, Security log access and health checks.
Intermediate
Guides tagged
#wef
Audit & Logging
Windows audit policy and Sysmon: a logging baseline
Configure advanced audit policy subcategories, command-line capture, log sizes, Sysmon and Windows Event Forwarding so Windows logs can answer who, what, where and when.
Foundation