Glossary
Windows Event Forwarding (WEF)
A built-in Windows feature that pushes selected event log entries from many computers to a central collector over WinRM, with no agent.
Windows Event Forwarding (WEF) uses the WS-Management protocol (WinRM) to send events from source computers to one or more Windows Event Collector servers. Administrators create subscriptions on the collector that define which events to collect using XPath queries. In the common source-initiated mode, a Group Policy setting points clients at the collector, they pull the subscription and push matching events to the Forwarded Events log, authenticated with Kerberos in a domain. No additional software is required on endpoints, and subscriptions can be filtered tightly to keep volume manageable.
Logs that stay on the host are lost when an attacker clears them or the disk is encrypted, and they cannot be correlated across machines. WEF gives a free, scalable way to centralise security events, PowerShell and Sysmon logs, often feeding a SIEM from the collector. Size collectors for event volume, keep subscriptions focused on high-value event IDs, and monitor for sources that stop reporting, because silence can mean a problem or tampering.
See Windows Event Forwarding at scale and Audit policy and Sysmon baseline.